Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
mcgen.rar
-
Size
19.6MB
-
Sample
241228-wc9ntazmh1
-
MD5
198091f543d1398313592c9bcf7f034c
-
SHA1
31b7c5e2e643b4632013e7cd239f913f3a446492
-
SHA256
e30e2fcbba7d281fe790f40b7054bf0f57315ca63141fa2a9f6533e99eb219e3
-
SHA512
217462e23b4b3ef74aa95d06684e5149f3045abba7ca2b9e8e3e5feb470fd80d1fe0a7fa57a03b18928038ac28b88aae5409e2c9af82cb677f3428ee932cb7f6
-
SSDEEP
393216:FgdsMgCzqQ2gdCIjJO7yhcvvovtnuDvM9p66J45Ukmr+JwEpNHztQ:FgdsNYu5IvQDvmsOkmgwEpFtQ
Behavioral task
behavioral1
Sample
mcgen.exe
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral2
Sample
mcgen.exe
Resource
win11-20241007-en
Malware Config
Targets
-
-
Target
mcgen.exe
-
Size
19.7MB
-
MD5
2dac1f22090b98958c3506c652ad4668
-
SHA1
6690d8ef9b410eb9ed04a206cca6fd8c139ce44b
-
SHA256
873cc8568f03c6878ec8b17fd75d83e9971a69b5d15ff0867f51cd6f07f997b9
-
SHA512
6d74f9960d1607324155bf0cfca99f3cfd1bf0c15d976c1e8ed2bfcce6a3c4851f69a07e3dc443cceee6cccec53db1c41fb536482b16be9f7f057f9e35ef852f
-
SSDEEP
393216:o5LHh+r4x+oVAymm1aAtwsjrsi7TveCIHL7HmBYXrYoaUN8:CB+rYh6KFiH6BYEoaQ8
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3