02f9bbabf54a11541103619af5d6f601d790ab515e252f56c88c9597693c113f | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

02f9bbabf5...3f.exe

windows7-x64

8

02f9bbabf5...3f.exe

windows10-2004-x64

8

Sharing

General

Target

02f9bbabf54a11541103619af5d6f601d790ab515e252f56c88c9597693c113f
Size

555KB
Sample

221012-v8fj6sdgem
MD5

781835edbe2cf74f624c22dde0614bed
SHA1

99be1c7ed8c654b99de76f0f10f313f7b1d5d68f
SHA256

02f9bbabf54a11541103619af5d6f601d790ab515e252f56c88c9597693c113f
SHA512

d970c89e997ac905f4e289d112cdd7b9622793b35f66cf83b16d4eb09904328a47878bc9cb192295a6d51374233f4299f3636b0656fd99e29c448cad437d1a73
SSDEEP

12288:ohg5Lhh65iCpNeH2OT1tXfjdUL1mjr+uB8VMujYMuOlQjEBvFMKb9WTDaGIdpdEn:ohgd2i2g2d1mzOVVYMu8xzb9YDTIdHjM

Score

8^/10

persistence upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

02f9bbabf54a11541103619af5d6f601d790ab515e252f56c88c9597693c113f.exe

Resource

win7-20220812-en

persistence upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

02f9bbabf54a11541103619af5d6f601d790ab515e252f56c88c9597693c113f.exe

Resource

win10v2004-20220812-en

persistence upx

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  02f9bbabf54a11541103619af5d6f601d790ab515e252f56c88c9597693c113f
- Size
  
  555KB
- MD5
  
  781835edbe2cf74f624c22dde0614bed
- SHA1
  
  99be1c7ed8c654b99de76f0f10f313f7b1d5d68f
- SHA256
  
  02f9bbabf54a11541103619af5d6f601d790ab515e252f56c88c9597693c113f
- SHA512
  
  d970c89e997ac905f4e289d112cdd7b9622793b35f66cf83b16d4eb09904328a47878bc9cb192295a6d51374233f4299f3636b0656fd99e29c448cad437d1a73
- SSDEEP
  
  12288:ohg5Lhh65iCpNeH2OT1tXfjdUL1mjr+uB8VMujYMuOlQjEBvFMKb9WTDaGIdpdEn:ohgd2i2g2d1mzOVVYMu8xzb9YDTIdHjM
Score

8^/10

persistence upx
- Blocklisted process makes network request
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

© 2018-2025

Terms | Privacy