Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

02042e0dd1...e3.exe

windows7-x64

10

02042e0dd1...e3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3

  • Size

    965KB

  • Sample

    221004-gax5nseben

  • MD5

    549c785be5f331099bb88475d75ae1c0

  • SHA1

    2e8b701cc9f0c1deb57d7599098c740695758e11

  • SHA256

    02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3

  • SHA512

    f8ff86427974a0c17eb76c6e57d4badeddabcc935a9eedfcedbd8eccd6d38e8b923797e66eb4dded411b5d72f5a99c2a96df0b0550ad318636e6a598d08f6fb0

  • SSDEEP

    12288:rj9l69ZU++3jUOIcr1MFNXJM44qwjxIZhKp1NplhifHW8NUnVuSIW5EykhXG5w:rDsOIcrMXP/wlIZha798NUnVPE05w

Score
10/10
persistence

Malware Config

Targets

    • Target

      02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3

    • Size

      965KB

    • MD5

      549c785be5f331099bb88475d75ae1c0

    • SHA1

      2e8b701cc9f0c1deb57d7599098c740695758e11

    • SHA256

      02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3

    • SHA512

      f8ff86427974a0c17eb76c6e57d4badeddabcc935a9eedfcedbd8eccd6d38e8b923797e66eb4dded411b5d72f5a99c2a96df0b0550ad318636e6a598d08f6fb0

    • SSDEEP

      12288:rj9l69ZU++3jUOIcr1MFNXJM44qwjxIZhKp1NplhifHW8NUnVuSIW5EykhXG5w:rDsOIcrMXP/wlIZha798NUnVPE05w

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks