a3f956d7eae1ee9c013886dc239d36736f58a9389b8cde3758b07b5533120515 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

8

a3f956d7ea...15.exe

windows7-x64

a3f956d7ea...15.exe

windows10-2004-x64

Sharing

General

Target

a3f956d7eae1ee9c013886dc239d36736f58a9389b8cde3758b07b5533120515
Size

658KB
Sample

221011-vkblbaege8
MD5

607d83d7d7d4ce8338ff2f55051bb8e9
SHA1

625e5605674cb295a228b8f0356cef1e60319dab
SHA256

a3f956d7eae1ee9c013886dc239d36736f58a9389b8cde3758b07b5533120515
SHA512

cfe1b5f3d90f76b8d9d33cd525598534c9c9544ee1461094a801f1fe724ddad23bd4b9ba3b8ebf476eb5409ab7fefd85d9f5ad5702fb04b4d6e224b03a278fdb
SSDEEP

6144:ivZ2iKiZ/QAKVfiROzkViZwc0W/1vNuMqTp/CelAaWjSZ/nWnKCXreOC0:q7wVfiRuqPW/dgMqIHdjSFWnKCXo

Score

10^/10

evasion persistence upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

a3f956d7eae1ee9c013886dc239d36736f58a9389b8cde3758b07b5533120515.exe

Resource

win7-20220812-en

evasion persistence upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

a3f956d7eae1ee9c013886dc239d36736f58a9389b8cde3758b07b5533120515.exe

Resource

win10v2004-20220812-en

evasion persistence upx

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  a3f956d7eae1ee9c013886dc239d36736f58a9389b8cde3758b07b5533120515
- Size
  
  658KB
- MD5
  
  607d83d7d7d4ce8338ff2f55051bb8e9
- SHA1
  
  625e5605674cb295a228b8f0356cef1e60319dab
- SHA256
  
  a3f956d7eae1ee9c013886dc239d36736f58a9389b8cde3758b07b5533120515
- SHA512
  
  cfe1b5f3d90f76b8d9d33cd525598534c9c9544ee1461094a801f1fe724ddad23bd4b9ba3b8ebf476eb5409ab7fefd85d9f5ad5702fb04b4d6e224b03a278fdb
- SSDEEP
  
  6144:ivZ2iKiZ/QAKVfiROzkViZwc0W/1vNuMqTp/CelAaWjSZ/nWnKCXreOC0:q7wVfiRuqPW/dgMqIHdjSFWnKCXo
Score

10^/10

evasion persistence upx
- Modifies WinLogon for persistence
  persistence
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx

© 2018-2025

Terms | Privacy