Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
NVIDIA_Optimize.10.08.exe
-
Size
7.6MB
-
Sample
250131-wjg75ssqbw
-
MD5
4ef401ce767d22c411db47f497399f83
-
SHA1
859148517a86d271ff5a8dfd22505e4448cb029f
-
SHA256
e3071efb97bcb8fee75f19bbd504e1dcd2f142f0541d794dea68596080ba00b2
-
SHA512
d73df8414765960d287a1b84af7637904b71696addc1a592a1a589e056ee49a5f1ad7ad7401c1e9227aac46c4955a14ed3eafca50e8c926a62b8204a48641652
-
SSDEEP
196608:mLD+kdPBawfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWq:45bJIHL7HmBYXrYoaUNN
Behavioral task
behavioral1
Sample
NVIDIA_Optimize.10.08.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
NVIDIA_Optimize.10.08.exe
Resource
win10v2004-20250129-en
Malware Config
Targets
-
-
Target
NVIDIA_Optimize.10.08.exe
-
Size
7.6MB
-
MD5
4ef401ce767d22c411db47f497399f83
-
SHA1
859148517a86d271ff5a8dfd22505e4448cb029f
-
SHA256
e3071efb97bcb8fee75f19bbd504e1dcd2f142f0541d794dea68596080ba00b2
-
SHA512
d73df8414765960d287a1b84af7637904b71696addc1a592a1a589e056ee49a5f1ad7ad7401c1e9227aac46c4955a14ed3eafca50e8c926a62b8204a48641652
-
SSDEEP
196608:mLD+kdPBawfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWq:45bJIHL7HmBYXrYoaUNN
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3