Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Built.exe

  • Size

    6.9MB

  • Sample

    241015-p7tshsvhpf

  • MD5

    da2616223b82ab4a76a7671b94506afa

  • SHA1

    53bdfb3871dd475d5136c27bd1479274558c0577

  • SHA256

    01b6628248bb3cb19a98d4f3db4e22d0ac9c81e986a4bdd1815f3b756066b48e

  • SHA512

    852c3cab00efd81cdeb937c1ec9a7b0eff1a10b94c97aad6f72d814d84bdf0a0aad49275297cccce05f624f35b8cfd6d96d2014de5e3ec9b20634681becc67e0

  • SSDEEP

    98304:/EDjWM8JEE1r4HamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYKJJcGhEIF/:/E07eNTfm/pf+xk4dWRptrbWOjgrs

Malware Config

Targets

    • Target

      Built.exe

    • Size

      6.9MB

    • MD5

      da2616223b82ab4a76a7671b94506afa

    • SHA1

      53bdfb3871dd475d5136c27bd1479274558c0577

    • SHA256

      01b6628248bb3cb19a98d4f3db4e22d0ac9c81e986a4bdd1815f3b756066b48e

    • SHA512

      852c3cab00efd81cdeb937c1ec9a7b0eff1a10b94c97aad6f72d814d84bdf0a0aad49275297cccce05f624f35b8cfd6d96d2014de5e3ec9b20634681becc67e0

    • SSDEEP

      98304:/EDjWM8JEE1r4HamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYKJJcGhEIF/:/E07eNTfm/pf+xk4dWRptrbWOjgrs

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Drops file in Drivers directory

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.