Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

35a18d64a5...7c.exe

windows7-x64

8

35a18d64a5...7c.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    35a18d64a53f6f9c18d7709f2c55757c893a328f30c38cb26eea2b07f570467c

  • Size

    712KB

  • Sample

    221004-jcwezahdh8

  • MD5

    2badfeb6ae78015ae0626faa442ca9ed

  • SHA1

    005c0e801215093148c12467edb78f9b60de5750

  • SHA256

    35a18d64a53f6f9c18d7709f2c55757c893a328f30c38cb26eea2b07f570467c

  • SHA512

    945ed35aaa9a877ba768b51343d843ce9983e7c468b46a8041a5338ba63f065461cd22bf963d8fe5af9d7e01bbe6be01070cc4dfce3332ee6a3917a17a535730

  • SSDEEP

    6144:HPNDXW8jOD/gSwgQM6/lkw3RRHxNjfOB8xOE5S:dW77gSw7WwB

Score
8/10
bootkitpersistenceupx

Malware Config

Targets

    • Target

      35a18d64a53f6f9c18d7709f2c55757c893a328f30c38cb26eea2b07f570467c

    • Size

      712KB

    • MD5

      2badfeb6ae78015ae0626faa442ca9ed

    • SHA1

      005c0e801215093148c12467edb78f9b60de5750

    • SHA256

      35a18d64a53f6f9c18d7709f2c55757c893a328f30c38cb26eea2b07f570467c

    • SHA512

      945ed35aaa9a877ba768b51343d843ce9983e7c468b46a8041a5338ba63f065461cd22bf963d8fe5af9d7e01bbe6be01070cc4dfce3332ee6a3917a17a535730

    • SSDEEP

      6144:HPNDXW8jOD/gSwgQM6/lkw3RRHxNjfOB8xOE5S:dW77gSw7WwB

    Score
    8/10
    bootkitpersistenceupx

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks