Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7299a4d81e...c3.exe

windows7-x64

10

7299a4d81e...c3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3

  • Size

    1.6MB

  • Sample

    220731-h6etmsfcar

  • MD5

    8af61cf426f27fabebb2f36a7fc09ecc

  • SHA1

    625dba2ddc6c0be037b22870407e988f284f5e64

  • SHA256

    7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3

  • SHA512

    00a4967ce6a02f1cf1badf86efcf8051bcb0cf7100071e059e1bbc688aaef41ae1eedce07a35330731d448806f7d45ed839afa0937cc31199c9b6a892a4f54ce

Score
10/10
troldeshdiscoverypersistenceransomwaretrojanupx

Malware Config

Targets

    • Target

      7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3

    • Size

      1.6MB

    • MD5

      8af61cf426f27fabebb2f36a7fc09ecc

    • SHA1

      625dba2ddc6c0be037b22870407e988f284f5e64

    • SHA256

      7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3

    • SHA512

      00a4967ce6a02f1cf1badf86efcf8051bcb0cf7100071e059e1bbc688aaef41ae1eedce07a35330731d448806f7d45ed839afa0937cc31199c9b6a892a4f54ce

    Score
    10/10
    troldeshdiscoverypersistenceransomwaretrojanupx

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks