Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Cracked Alantis.exe
-
Size
7.6MB
-
Sample
250126-ag12kswrgn
-
MD5
458b3d5fcd051179953731d43d2a2d4e
-
SHA1
08ac1c70f44455a09c23ce66f8df71a461b87108
-
SHA256
d543385a2d3b345337bbb7bf91feadafddf6ac720ce0a606c1008b7307fbe957
-
SHA512
b68ac316f384becdcdf18427cef7d7fba068fad7ec38bf98e88b26333096ab97ed3716300f2908e0a8a9aafa17a86cf9228397ab2db4d203560ddcb9132445de
-
SSDEEP
196608:KJgFTewfI9jUC2gYBYv3vbWY+iITm1U6fd1EE:lFTVIH2gYBgDW/TOzbH
Behavioral task
behavioral1
Sample
Cracked Alantis.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Cracked Alantis.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
Cracked Alantis.exe
-
Size
7.6MB
-
MD5
458b3d5fcd051179953731d43d2a2d4e
-
SHA1
08ac1c70f44455a09c23ce66f8df71a461b87108
-
SHA256
d543385a2d3b345337bbb7bf91feadafddf6ac720ce0a606c1008b7307fbe957
-
SHA512
b68ac316f384becdcdf18427cef7d7fba068fad7ec38bf98e88b26333096ab97ed3716300f2908e0a8a9aafa17a86cf9228397ab2db4d203560ddcb9132445de
-
SSDEEP
196608:KJgFTewfI9jUC2gYBYv3vbWY+iITm1U6fd1EE:lFTVIH2gYBgDW/TOzbH
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3