Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

bc6f984016...f1.exe

windows7-x64

10

bc6f984016...f1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1

  • Size

    725KB

  • Sample

    221002-y7gmmahdh4

  • MD5

    33909b737637efe050dfc8083630ed66

  • SHA1

    21a699845ad17fc3db3608b3c1fd4002ef057145

  • SHA256

    bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1

  • SHA512

    9d51cd97a6616358fdc8ffe93f249936b1ed9062ca9ecd47abceae1c852bd3334ee2b88536007dfc8b86b947a8dce1171e0f741136a031940953026ffc5d5dd7

  • SSDEEP

    6144:a+nglw9ayQv3ahvyn/PU7O0KXgTTSjiZ7ifckWEN4+Ugh+VuSfCpJipyfCpJipb:rjS3Yvyn/0TvhifHW8NUnVuSaXiQaXix

Score
10/10
persistence

Malware Config

Targets

    • Target

      bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1

    • Size

      725KB

    • MD5

      33909b737637efe050dfc8083630ed66

    • SHA1

      21a699845ad17fc3db3608b3c1fd4002ef057145

    • SHA256

      bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1

    • SHA512

      9d51cd97a6616358fdc8ffe93f249936b1ed9062ca9ecd47abceae1c852bd3334ee2b88536007dfc8b86b947a8dce1171e0f741136a031940953026ffc5d5dd7

    • SSDEEP

      6144:a+nglw9ayQv3ahvyn/PU7O0KXgTTSjiZ7ifckWEN4+Ugh+VuSfCpJipyfCpJipb:rjS3Yvyn/0TvhifHW8NUnVuSaXiQaXix

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks