Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    test.exe

  • Size

    8.2MB

  • Sample

    241217-ba8nhswnar

  • MD5

    d08adbba55000fc18fd3a6c425618bf3

  • SHA1

    00afee53dba5be8f0694ef4ce6835d42d046cd34

  • SHA256

    3d010f14e8f4aaeab74d7bfbe245e17d0f2174219683ace275318e0826a7678c

  • SHA512

    58ddb321fe5f9ba72ab45c619c89acd2cd9a19812d2bff7988a94b854d92a3f8d859d1502be703b6b0a7546730f3fc37d96790f40b71011edbc0dd6c10a81a55

  • SSDEEP

    196608:k09QXwuL9BurErvI9pWjgN3ZdahF0pbH1AYSEp1CtQsNI/SBmUa:vmBurEUWjqeWxQX6nWva

Malware Config

Targets

    • Target

      test.exe

    • Size

      8.2MB

    • MD5

      d08adbba55000fc18fd3a6c425618bf3

    • SHA1

      00afee53dba5be8f0694ef4ce6835d42d046cd34

    • SHA256

      3d010f14e8f4aaeab74d7bfbe245e17d0f2174219683ace275318e0826a7678c

    • SHA512

      58ddb321fe5f9ba72ab45c619c89acd2cd9a19812d2bff7988a94b854d92a3f8d859d1502be703b6b0a7546730f3fc37d96790f40b71011edbc0dd6c10a81a55

    • SSDEEP

      196608:k09QXwuL9BurErvI9pWjgN3ZdahF0pbH1AYSEp1CtQsNI/SBmUa:vmBurEUWjqeWxQX6nWva

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.