Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5f2f873e60...70.exe

windows7-x64

10

5f2f873e60...70.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170

  • Size

    129KB

  • Sample

    221004-hdh1lafhc7

  • MD5

    4fcc3fdc3960f40dcecfc6fff02738ef

  • SHA1

    dcc5c4562c952c31f80cc32843b24bc32b3617a7

  • SHA256

    5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170

  • SHA512

    5c6bf1dcca32425c9d3259fae88011bfe3c85e09624d8d84d6729d422fce02ae19e177a2e5de53917247aeb28824d7bf7d49e82b8fbf3645b6e78746fc803095

  • SSDEEP

    3072:p8qlbOAxQFH9JPcQl1Q5brufmA6HVTIdddj1s6ElECDd:LbOAIXNl1Qp1J1TIdddj1snE8

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170

    • Size

      129KB

    • MD5

      4fcc3fdc3960f40dcecfc6fff02738ef

    • SHA1

      dcc5c4562c952c31f80cc32843b24bc32b3617a7

    • SHA256

      5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170

    • SHA512

      5c6bf1dcca32425c9d3259fae88011bfe3c85e09624d8d84d6729d422fce02ae19e177a2e5de53917247aeb28824d7bf7d49e82b8fbf3645b6e78746fc803095

    • SSDEEP

      3072:p8qlbOAxQFH9JPcQl1Q5brufmA6HVTIdddj1s6ElECDd:LbOAIXNl1Qp1J1TIdddj1snE8

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks