Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

a81864ca52...ce.exe

windows7-x64

10

a81864ca52...ce.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a81864ca523bac00b38496fee13cfa4e7f9d48dc08e81766c277525ec050b5ce

  • Size

    456KB

  • Sample

    221012-spf1gshaek

  • MD5

    78ceaec5ce59fb0e606fa674c9894bfb

  • SHA1

    0948b0cecd5150d8be281e6a398a3ec52b90719d

  • SHA256

    a81864ca523bac00b38496fee13cfa4e7f9d48dc08e81766c277525ec050b5ce

  • SHA512

    69ecd76167595ac30999eef0a1ab83a3dc81fe32fb0492ba1ed5a2715bb52fe256f5e5fa7541b8e482f056730226d56537056ce5d4c7311678ec6d0dff6b4dd7

  • SSDEEP

    12288:jEVXKpmokdif4JgTIoq43H2cE05nMx11DGkfb7i:jEtRliAJgMe3H2cJCx1YOb7i

Score
10/10
bootkitevasionpersistence

Malware Config

Targets

    • Target

      a81864ca523bac00b38496fee13cfa4e7f9d48dc08e81766c277525ec050b5ce

    • Size

      456KB

    • MD5

      78ceaec5ce59fb0e606fa674c9894bfb

    • SHA1

      0948b0cecd5150d8be281e6a398a3ec52b90719d

    • SHA256

      a81864ca523bac00b38496fee13cfa4e7f9d48dc08e81766c277525ec050b5ce

    • SHA512

      69ecd76167595ac30999eef0a1ab83a3dc81fe32fb0492ba1ed5a2715bb52fe256f5e5fa7541b8e482f056730226d56537056ce5d4c7311678ec6d0dff6b4dd7

    • SSDEEP

      12288:jEVXKpmokdif4JgTIoq43H2cE05nMx11DGkfb7i:jEtRliAJgMe3H2cJCx1YOb7i

    Score
    10/10
    bootkitevasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks