ec1af6d0d68792057d6f13a9979ab7dc7811c66804688eeda83397413cf7c2c6 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

8

ec1af6d0d6...c6.exe

windows7-x64

ec1af6d0d6...c6.exe

windows10-2004-x64

Sharing

General

Target

ec1af6d0d68792057d6f13a9979ab7dc7811c66804688eeda83397413cf7c2c6
Size

617KB
Sample

221003-n5xkysefdm
MD5

62a9627d19fd3eaba65392ab7044e380
SHA1

11f6f0773c4c40d227143973c1e3fd9bfe21d66e
SHA256

ec1af6d0d68792057d6f13a9979ab7dc7811c66804688eeda83397413cf7c2c6
SHA512

f09c24a8a7a6895f81df86aa59525ea414ed395e962d3c94cd4acf5e18368187462787e81c5d4e8e05909fb40d1bc0ffc5dae68dd5778f34a894d41c865dee87
SSDEEP

6144:YVY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bco2KWF:YgDhdkq5BCoC5LfWSLTUQpr2Zu19Q3

Score

10^/10

evasion persistence upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

ec1af6d0d68792057d6f13a9979ab7dc7811c66804688eeda83397413cf7c2c6.exe

Resource

win7-20220812-en

evasion persistence upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

ec1af6d0d68792057d6f13a9979ab7dc7811c66804688eeda83397413cf7c2c6.exe

Resource

win10v2004-20220812-en

evasion persistence upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  ec1af6d0d68792057d6f13a9979ab7dc7811c66804688eeda83397413cf7c2c6
- Size
  
  617KB
- MD5
  
  62a9627d19fd3eaba65392ab7044e380
- SHA1
  
  11f6f0773c4c40d227143973c1e3fd9bfe21d66e
- SHA256
  
  ec1af6d0d68792057d6f13a9979ab7dc7811c66804688eeda83397413cf7c2c6
- SHA512
  
  f09c24a8a7a6895f81df86aa59525ea414ed395e962d3c94cd4acf5e18368187462787e81c5d4e8e05909fb40d1bc0ffc5dae68dd5778f34a894d41c865dee87
- SSDEEP
  
  6144:YVY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bco2KWF:YgDhdkq5BCoC5LfWSLTUQpr2Zu19Q3
Score

10^/10

evasion persistence upx
- Modifies WinLogon for persistence
  persistence
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx

© 2018-2025

Terms | Privacy