bea4aac28a69027efe1af3ad387ce3f89d2b90ea6c9aa6460f64cc4126c38337 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

8

bea4aac28a...37.exe

windows7-x64

bea4aac28a...37.exe

windows10-2004-x64

Sharing

General

Target

bea4aac28a69027efe1af3ad387ce3f89d2b90ea6c9aa6460f64cc4126c38337
Size

661KB
Sample

221003-n5yg9aeeg2
MD5

689481e740f42ffb4feba17baabddf60
SHA1

f2dbbbef245ac76d7c337aa6f84a4816a7952391
SHA256

bea4aac28a69027efe1af3ad387ce3f89d2b90ea6c9aa6460f64cc4126c38337
SHA512

eed17db502ca8bcde074c71cd69f37372df41e194175636ee16a3c4d278eeb849711c5a5f079ab150fe7ef1b85810b674bc4dd5924ccf3cdfe8fd765e746344c
SSDEEP

6144:eVY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bco2KWF:egDhdkq5BCoC5LfWSLTUQpr2Zu19Q3

Score

10^/10

evasion persistence upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

bea4aac28a69027efe1af3ad387ce3f89d2b90ea6c9aa6460f64cc4126c38337.exe

Resource

win7-20220812-en

evasion persistence upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

bea4aac28a69027efe1af3ad387ce3f89d2b90ea6c9aa6460f64cc4126c38337.exe

Resource

win10v2004-20220812-en

evasion persistence upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  bea4aac28a69027efe1af3ad387ce3f89d2b90ea6c9aa6460f64cc4126c38337
- Size
  
  661KB
- MD5
  
  689481e740f42ffb4feba17baabddf60
- SHA1
  
  f2dbbbef245ac76d7c337aa6f84a4816a7952391
- SHA256
  
  bea4aac28a69027efe1af3ad387ce3f89d2b90ea6c9aa6460f64cc4126c38337
- SHA512
  
  eed17db502ca8bcde074c71cd69f37372df41e194175636ee16a3c4d278eeb849711c5a5f079ab150fe7ef1b85810b674bc4dd5924ccf3cdfe8fd765e746344c
- SSDEEP
  
  6144:eVY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bco2KWF:egDhdkq5BCoC5LfWSLTUQpr2Zu19Q3
Score

10^/10

evasion persistence upx
- Modifies WinLogon for persistence
  persistence
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx

© 2018-2025

Terms | Privacy