Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1e499f4181...f1.exe

windows7-x64

10

1e499f4181...f1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1e499f4181cdd44d44fef3a5096af26d79ed3183a10b88a40fca4a274ae7fcf1

  • Size

    573KB

  • Sample

    221003-hmfa3acae2

  • MD5

    6a7fb43bc8f8f3930ba7a4540d6c16e0

  • SHA1

    390f62373e50c1e7848a79cf87b9c292fc46e476

  • SHA256

    1e499f4181cdd44d44fef3a5096af26d79ed3183a10b88a40fca4a274ae7fcf1

  • SHA512

    20f6b60cafc87c4621839448d27847179a0d979be81651da84824ddc8af0c6775f68adeebb0cc882ef635303f1e801af6fc0ab1573d1516cc1009ff433c26ffa

  • SSDEEP

    12288:bChzggPQoSk3qRlra/kb1CRnTP1Vs3kkG6FD:+hzgn/BcUCdPf0kkG6

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      1e499f4181cdd44d44fef3a5096af26d79ed3183a10b88a40fca4a274ae7fcf1

    • Size

      573KB

    • MD5

      6a7fb43bc8f8f3930ba7a4540d6c16e0

    • SHA1

      390f62373e50c1e7848a79cf87b9c292fc46e476

    • SHA256

      1e499f4181cdd44d44fef3a5096af26d79ed3183a10b88a40fca4a274ae7fcf1

    • SHA512

      20f6b60cafc87c4621839448d27847179a0d979be81651da84824ddc8af0c6775f68adeebb0cc882ef635303f1e801af6fc0ab1573d1516cc1009ff433c26ffa

    • SSDEEP

      12288:bChzggPQoSk3qRlra/kb1CRnTP1Vs3kkG6FD:+hzgn/BcUCdPf0kkG6

    Score
    10/10
    evasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks