Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
3dc730302dc71232ee3bb36dc669f3ae.exe
-
Size
1.7MB
-
Sample
241219-h4yhzavja1
-
MD5
3dc730302dc71232ee3bb36dc669f3ae
-
SHA1
268717a1d24ef6be6b40b16f9e7f731ae7205083
-
SHA256
570ee6ea154dc3da02a3e52122c89a504fdea8b8b622a5e13848804af7486b84
-
SHA512
f0d6d22f52e498bac2327e7928ade046d57b254cdf97b6a490a0e6b515873b1832ecd66c2daad8761ff0f1f26ce1e84f0b4b7e80da5a7ab0da04890460eac005
-
SSDEEP
49152:64IQwE9/jGUecQ0yTipjQgMtyuIOZiul:6hQTBjGXcMTidLMtyuIQJ
Static task
static1
Behavioral task
behavioral1
Sample
3dc730302dc71232ee3bb36dc669f3ae.exe
Resource
win7-20240903-en
Malware Config
Extracted
lumma
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Targets
-
-
Target
3dc730302dc71232ee3bb36dc669f3ae.exe
-
Size
1.7MB
-
MD5
3dc730302dc71232ee3bb36dc669f3ae
-
SHA1
268717a1d24ef6be6b40b16f9e7f731ae7205083
-
SHA256
570ee6ea154dc3da02a3e52122c89a504fdea8b8b622a5e13848804af7486b84
-
SHA512
f0d6d22f52e498bac2327e7928ade046d57b254cdf97b6a490a0e6b515873b1832ecd66c2daad8761ff0f1f26ce1e84f0b4b7e80da5a7ab0da04890460eac005
-
SSDEEP
49152:64IQwE9/jGUecQ0yTipjQgMtyuIOZiul:6hQTBjGXcMTidLMtyuIQJ
-
Lumma family
-
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3