Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Loader.rar

windows7-x64

1

Loader.rar

windows10-2004-x64

1

Loader/Loader.exe

windows7-x64

7

Loader/Loader.exe

windows10-2004-x64

8

Loader/vcomp140.dll

windows7-x64

1

Loader/vcomp140.dll

windows10-2004-x64

1

Loader/vcruntime.dll

windows7-x64

1

Loader/vcruntime.dll

windows10-2004-x64

1

Resubmissions

26/03/2025, 16:44

250326-t9brya1ls3 10

26/03/2025, 16:43

250326-t8ahgsyxbv 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Loader.rar

  • Size

    7.5MB

  • Sample

    250326-t8ahgsyxbv

  • MD5

    7d67a76a8354226bdef759e77559ef4b

  • SHA1

    ce16e1d54a98f40f627d59fcad6731d4d1c7848e

  • SHA256

    348dc41dc1e75835c4c49bd5b12849966734b44c54f4f4be00a7cb9ac5455861

  • SHA512

    f6ab8dc861ac5a9c5f6970e747e13b3feba4bf78ea5aed9e0d9e0aba671a1ecc2fcf10ea878ce224794888231d9c4d9d32bc799975be7d4520e009300935e4a4

  • SSDEEP

    196608:zg5D7Sn0mxSg0AWelXnsQs8uks0CCw8dipUHFIS87:zg5D203ghXnq1X0/daGIS87

Score
10/10
blankgrabbercollectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealerupx

Malware Config

Targets

    • Target

      Loader.rar

    • Size

      7.5MB

    • MD5

      7d67a76a8354226bdef759e77559ef4b

    • SHA1

      ce16e1d54a98f40f627d59fcad6731d4d1c7848e

    • SHA256

      348dc41dc1e75835c4c49bd5b12849966734b44c54f4f4be00a7cb9ac5455861

    • SHA512

      f6ab8dc861ac5a9c5f6970e747e13b3feba4bf78ea5aed9e0d9e0aba671a1ecc2fcf10ea878ce224794888231d9c4d9d32bc799975be7d4520e009300935e4a4

    • SSDEEP

      196608:zg5D7Sn0mxSg0AWelXnsQs8uks0CCw8dipUHFIS87:zg5D203ghXnq1X0/daGIS87

    Score
    1/10
    behavioral1behavioral2

    • Target

      Loader/Loader.exe

    • Size

      7.5MB

    • MD5

      251ac55d55b47ec078473eeaa1e510e7

    • SHA1

      1126ce753d5f4916e5e4f0fa5fa002bd7bce181b

    • SHA256

      60bbd89cca19b257dd70d37ce4907d86e96b2711da5d945dd4204a88edad318b

    • SHA512

      90120ff2ac2ad04758279695b43b45759829535d7b8519a2907bc2b1169a1e510a7e383e2347e7f15225de1a924bd9b77637d9c77e7838d99b062c279ae3912f

    • SSDEEP

      196608:pWOgoiwfI9jUCH0+n4/JKIYJmg+Irj+dD1SAxw:28IHU+GJPYf9ydD1s

    Score
    8/10
    upxcollectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

      collection

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral3behavioral4

    • Target

      Loader/vcomp140.dll

    • Size

      176KB

    • MD5

      884c6f8718fd95c25e16a4789ae3bf7a

    • SHA1

      33f7e6846498871927d21bed11cc4ef41804112a

    • SHA256

      f8d8aca399a0f7e40b2993584404b31f13bf18ea657a5feb85b37b15a249a275

    • SHA512

      48384af2f6359ca3ee6996fc34df8c357164097f0c0c5cb30f5bd080baa6af3b4bcada17fb94933a99955f97c4ac0e554ca2373a5638e29db84e8318165c7b0c

    • SSDEEP

      3072:+Pr3XpMvAiR3LQpxELm3uFX1TfgZhPlUDJR9ZURc/5:+znSvAiO+m3uFFOj+O6/5

    Score
    1/10
    behavioral5behavioral6

    • Target

      Loader/vcruntime.dll

    • Size

      94KB

    • MD5

      11d9ac94e8cb17bd23dea89f8e757f18

    • SHA1

      d4fb80a512486821ad320c4fd67abcae63005158

    • SHA256

      e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

    • SHA512

      aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

    • SSDEEP

      1536:yDHLG4SsAzAvadZw+1Hcx8uIYNUzUnHg4becbK/zJrCT:yDrfZ+jPYNznHg4becbK/Fr

    Score
    1/10
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Obfuscated Files or Information

1
T1027

Command Obfuscation

1
T1027.010

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Browser Information Discovery

1
T1217

Process Discovery

1
T1057

System Information Discovery

3
T1082

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Clipboard Data

1
T1115

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks