Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    3f5928c606208c18b770c53e231d7b9444d8d76b032acc2c549cde011cd73b80

  • Size

    13.8MB

  • Sample

    241027-176ymavbnr

  • MD5

    7c8d2604582f69ec533c019a0b92b918

  • SHA1

    15743e85d3db19d505f7b80c0b0e16f6b7057e97

  • SHA256

    3f5928c606208c18b770c53e231d7b9444d8d76b032acc2c549cde011cd73b80

  • SHA512

    a8cc7a15a7b6d60bb9a8eee767db5a0f1b9a875f35ea85bb73ec658e706f4c60c18f97715ae07a34e624ed7b4ca79299001b361b991658a94774c0f7847f9620

  • SSDEEP

    393216:qsoRrDjtLKkOa8ps6puAktIzwf+6pJTRGSUa+arvSPH:+RrDjt2kOa87QRa+SaaH

Malware Config

Targets

    • Target

      3f5928c606208c18b770c53e231d7b9444d8d76b032acc2c549cde011cd73b80

    • Size

      13.8MB

    • MD5

      7c8d2604582f69ec533c019a0b92b918

    • SHA1

      15743e85d3db19d505f7b80c0b0e16f6b7057e97

    • SHA256

      3f5928c606208c18b770c53e231d7b9444d8d76b032acc2c549cde011cd73b80

    • SHA512

      a8cc7a15a7b6d60bb9a8eee767db5a0f1b9a875f35ea85bb73ec658e706f4c60c18f97715ae07a34e624ed7b4ca79299001b361b991658a94774c0f7847f9620

    • SSDEEP

      393216:qsoRrDjtLKkOa8ps6puAktIzwf+6pJTRGSUa+arvSPH:+RrDjt2kOa87QRa+SaaH

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks