Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Built.exe
-
Size
6.9MB
-
Sample
241015-p7tshsvhpf
-
MD5
da2616223b82ab4a76a7671b94506afa
-
SHA1
53bdfb3871dd475d5136c27bd1479274558c0577
-
SHA256
01b6628248bb3cb19a98d4f3db4e22d0ac9c81e986a4bdd1815f3b756066b48e
-
SHA512
852c3cab00efd81cdeb937c1ec9a7b0eff1a10b94c97aad6f72d814d84bdf0a0aad49275297cccce05f624f35b8cfd6d96d2014de5e3ec9b20634681becc67e0
-
SSDEEP
98304:/EDjWM8JEE1r4HamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYKJJcGhEIF/:/E07eNTfm/pf+xk4dWRptrbWOjgrs
Behavioral task
behavioral1
Sample
Built.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Built.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
Built.exe
-
Size
6.9MB
-
MD5
da2616223b82ab4a76a7671b94506afa
-
SHA1
53bdfb3871dd475d5136c27bd1479274558c0577
-
SHA256
01b6628248bb3cb19a98d4f3db4e22d0ac9c81e986a4bdd1815f3b756066b48e
-
SHA512
852c3cab00efd81cdeb937c1ec9a7b0eff1a10b94c97aad6f72d814d84bdf0a0aad49275297cccce05f624f35b8cfd6d96d2014de5e3ec9b20634681becc67e0
-
SSDEEP
98304:/EDjWM8JEE1r4HamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYKJJcGhEIF/:/E07eNTfm/pf+xk4dWRptrbWOjgrs
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3