Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8

af87629834...b0.exe

windows7-x64

8

af87629834...b0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    af87629834c2a4c9f2abaa9fb16c139699ff72276bba5277eb71bba90677bcb0

  • Size

    237KB

  • Sample

    221011-n97aysdcg7

  • MD5

    6e0b6a02371c80ff3c1474a332e5bf76

  • SHA1

    6fff788f07748bcedeb7188f67ebd00e24ba50d6

  • SHA256

    af87629834c2a4c9f2abaa9fb16c139699ff72276bba5277eb71bba90677bcb0

  • SHA512

    919ac1ef06e1cb61949560a281c3e857410fd3527b1a71175cf1ee4986432245b26f696d83d3e62b30c11488c32fbda58cbf4bc640391e8a30cd79dc769205d6

  • SSDEEP

    6144:JJnf0qkLDB8wuRclrKtBoYBqCOTt1h49cNUmgGug:7hkiIlWBoYBqnx1h49cNUmR

Score
10/10
persistenceupx

Malware Config

Targets

    • Target

      af87629834c2a4c9f2abaa9fb16c139699ff72276bba5277eb71bba90677bcb0

    • Size

      237KB

    • MD5

      6e0b6a02371c80ff3c1474a332e5bf76

    • SHA1

      6fff788f07748bcedeb7188f67ebd00e24ba50d6

    • SHA256

      af87629834c2a4c9f2abaa9fb16c139699ff72276bba5277eb71bba90677bcb0

    • SHA512

      919ac1ef06e1cb61949560a281c3e857410fd3527b1a71175cf1ee4986432245b26f696d83d3e62b30c11488c32fbda58cbf4bc640391e8a30cd79dc769205d6

    • SSDEEP

      6144:JJnf0qkLDB8wuRclrKtBoYBqCOTt1h49cNUmgGug:7hkiIlWBoYBqnx1h49cNUmR

    Score
    10/10
    persistenceupx

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks