Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    SecuriteInfo.com.Win32.DropperX-gen.12106.14923.exe

  • Size

    559KB

  • Sample

    250328-f1lznastcw

  • MD5

    9ccd4e15308b5c6be7660aa380e43b95

  • SHA1

    e436419498e3cc9aee203f3ac7c4310cf19f84be

  • SHA256

    4078adf62c07585b15a332154580255ea508ba5f23ad43ce7af8d2f07d132d7e

  • SHA512

    e767331fca49b85d7301e274e0b61a97825d067415e71e2f13d32f1f4881f17c0d9d1d59f7b450f1b41d0f86f9259c081498e0aa155cb82c024aaab385111663

  • SSDEEP

    12288:2DQiKax7HaLTUnrNuSoLAMphAQ7ZQy+yBlFQUV8qkR:eQiFHaLTU5uzjyiSy5BlFPVC

Malware Config

Targets

    • Target

      SecuriteInfo.com.Win32.DropperX-gen.12106.14923.exe

    • Size

      559KB

    • MD5

      9ccd4e15308b5c6be7660aa380e43b95

    • SHA1

      e436419498e3cc9aee203f3ac7c4310cf19f84be

    • SHA256

      4078adf62c07585b15a332154580255ea508ba5f23ad43ce7af8d2f07d132d7e

    • SHA512

      e767331fca49b85d7301e274e0b61a97825d067415e71e2f13d32f1f4881f17c0d9d1d59f7b450f1b41d0f86f9259c081498e0aa155cb82c024aaab385111663

    • SSDEEP

      12288:2DQiKax7HaLTUnrNuSoLAMphAQ7ZQy+yBlFQUV8qkR:eQiFHaLTU5uzjyiSy5BlFPVC

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks