Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Built.exe

  • Size

    6.9MB

  • Sample

    241102-cxcp2axgpb

  • MD5

    5c324e8890cd775ce88c4fd9caf64e24

  • SHA1

    dfcc04f683af634157a7220abe04af4cf9d70777

  • SHA256

    e865599aece38cb40a370f3ebb5a9ac0e9e2c3b8a10b7affb2ded313ffa2a9e7

  • SHA512

    63c671e5cbf134ea0cba4e7608b22d8592dd839330c5121512a2ad79cfceb24d2dc1becd858ed3d212fa40a5f038e2b3a177314b593d8cace4653d6ce71f06c8

  • SSDEEP

    98304:dVpDDjWM8JEE1FZamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEIS:dD0OeNTfm/pf+xk4dWRpmrbW3jmrw

Malware Config

Targets

    • Target

      Built.exe

    • Size

      6.9MB

    • MD5

      5c324e8890cd775ce88c4fd9caf64e24

    • SHA1

      dfcc04f683af634157a7220abe04af4cf9d70777

    • SHA256

      e865599aece38cb40a370f3ebb5a9ac0e9e2c3b8a10b7affb2ded313ffa2a9e7

    • SHA512

      63c671e5cbf134ea0cba4e7608b22d8592dd839330c5121512a2ad79cfceb24d2dc1becd858ed3d212fa40a5f038e2b3a177314b593d8cace4653d6ce71f06c8

    • SSDEEP

      98304:dVpDDjWM8JEE1FZamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEIS:dD0OeNTfm/pf+xk4dWRpmrbW3jmrw

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Drops file in Drivers directory

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks