Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    mcgen.rar

  • Size

    19.6MB

  • Sample

    241228-wc9ntazmh1

  • MD5

    198091f543d1398313592c9bcf7f034c

  • SHA1

    31b7c5e2e643b4632013e7cd239f913f3a446492

  • SHA256

    e30e2fcbba7d281fe790f40b7054bf0f57315ca63141fa2a9f6533e99eb219e3

  • SHA512

    217462e23b4b3ef74aa95d06684e5149f3045abba7ca2b9e8e3e5feb470fd80d1fe0a7fa57a03b18928038ac28b88aae5409e2c9af82cb677f3428ee932cb7f6

  • SSDEEP

    393216:FgdsMgCzqQ2gdCIjJO7yhcvvovtnuDvM9p66J45Ukmr+JwEpNHztQ:FgdsNYu5IvQDvmsOkmgwEpFtQ

Malware Config

Targets

    • Target

      mcgen.exe

    • Size

      19.7MB

    • MD5

      2dac1f22090b98958c3506c652ad4668

    • SHA1

      6690d8ef9b410eb9ed04a206cca6fd8c139ce44b

    • SHA256

      873cc8568f03c6878ec8b17fd75d83e9971a69b5d15ff0867f51cd6f07f997b9

    • SHA512

      6d74f9960d1607324155bf0cfca99f3cfd1bf0c15d976c1e8ed2bfcce6a3c4851f69a07e3dc443cceee6cccec53db1c41fb536482b16be9f7f057f9e35ef852f

    • SSDEEP

      393216:o5LHh+r4x+oVAymm1aAtwsjrsi7TveCIHL7HmBYXrYoaUN8:CB+rYh6KFiH6BYEoaQ8

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Drops file in Drivers directory

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • Hide Artifacts: Hidden Files and Directories

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks