Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
BuildAnti.exe
-
Size
6.8MB
-
Sample
250131-z12vnayreq
-
MD5
6ca3af9f2b35018656c3e3c50fed4d5b
-
SHA1
db76da5f8cfee5c4ad613d238231968608f4576e
-
SHA256
1f36c3cb1c8b3cf49b38b47ca5f51c81fb0c0e089ec23e915308467f0515bcc1
-
SHA512
249711de4ca1fdda7582f2236cad821e6e597a37f182a0fc61d3e77c93355403549c54228b3a326f195ae3df2f43e6e1e85bfbbfae18c2390beab673d4538453
-
SSDEEP
98304:vvkwN+MdA5wqMXh8MMhJMjarJaon7JPzf+JiUCS3swhzqgez7DoDZDJ1n6hBnLnU:vvV1UB6ylnlPzf+JiJCsmFMvcn6hVvQ
Behavioral task
behavioral1
Sample
BuildAnti.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
BuildAnti.exe
Resource
win10v2004-20250129-en
Malware Config
Targets
-
-
Target
BuildAnti.exe
-
Size
6.8MB
-
MD5
6ca3af9f2b35018656c3e3c50fed4d5b
-
SHA1
db76da5f8cfee5c4ad613d238231968608f4576e
-
SHA256
1f36c3cb1c8b3cf49b38b47ca5f51c81fb0c0e089ec23e915308467f0515bcc1
-
SHA512
249711de4ca1fdda7582f2236cad821e6e597a37f182a0fc61d3e77c93355403549c54228b3a326f195ae3df2f43e6e1e85bfbbfae18c2390beab673d4538453
-
SSDEEP
98304:vvkwN+MdA5wqMXh8MMhJMjarJaon7JPzf+JiUCS3swhzqgez7DoDZDJ1n6hBnLnU:vvV1UB6ylnlPzf+JiJCsmFMvcn6hVvQ
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3