Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5135d1b17a...cb.exe

windows7-x64

10

5135d1b17a...cb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb

  • Size

    504KB

  • Sample

    221011-jm2pqscff4

  • MD5

    6afe941c6ac3443fc98b33d786ba0548

  • SHA1

    4c6d722a95f001a237880d54790616884ebf326a

  • SHA256

    5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb

  • SHA512

    00637db5804e1d28c8e262277bead5970b2e73ff6fce5ac55287f64c54974734de7df7e3530b59ead6eface557de5020395d13028f8ac676dd87a650f0304d29

  • SSDEEP

    6144:syvhitdjyuhy/uqIVwMpIndxyD0w5GziWmdS1CeoiC2DZnlDRXpm1deeC+wDm8:syod25uBWibpkCeBNNuRC+gm8

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb

    • Size

      504KB

    • MD5

      6afe941c6ac3443fc98b33d786ba0548

    • SHA1

      4c6d722a95f001a237880d54790616884ebf326a

    • SHA256

      5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb

    • SHA512

      00637db5804e1d28c8e262277bead5970b2e73ff6fce5ac55287f64c54974734de7df7e3530b59ead6eface557de5020395d13028f8ac676dd87a650f0304d29

    • SSDEEP

      6144:syvhitdjyuhy/uqIVwMpIndxyD0w5GziWmdS1CeoiC2DZnlDRXpm1deeC+wDm8:syod25uBWibpkCeBNNuRC+gm8

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks