Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
SNORMWARE.exe
-
Size
7.8MB
-
Sample
250112-ccvecasqfm
-
MD5
fad5c7ebbba0e09ad54cd6e77d9d72aa
-
SHA1
92c7e1322d934e4ea9efe07955db722e3350a9c5
-
SHA256
482f1a5a2d052247b1d024e6d1fdb9ac52bbfa5c28b9fad5f255be33f82cd2db
-
SHA512
47a1728bedfcaae54bdd0ba7b1e14d7b8732bb828aa655d774eebb8034dcf4ef836655d7755754cc08050d2cde8069de6607941fbd59dfa8ab83ceb17e96b136
-
SSDEEP
196608:D/YXD+kddwfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWY:+5AIHL7HmBYXrYoaUNP
Behavioral task
behavioral1
Sample
SNORMWARE.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SNORMWARE.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
SNORMWARE.exe
-
Size
7.8MB
-
MD5
fad5c7ebbba0e09ad54cd6e77d9d72aa
-
SHA1
92c7e1322d934e4ea9efe07955db722e3350a9c5
-
SHA256
482f1a5a2d052247b1d024e6d1fdb9ac52bbfa5c28b9fad5f255be33f82cd2db
-
SHA512
47a1728bedfcaae54bdd0ba7b1e14d7b8732bb828aa655d774eebb8034dcf4ef836655d7755754cc08050d2cde8069de6607941fbd59dfa8ab83ceb17e96b136
-
SSDEEP
196608:D/YXD+kddwfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWY:+5AIHL7HmBYXrYoaUNP
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3