2408c7c6edbe0c4468f33b5ff15d025ab40b2bc8f911da10b711cc5cf1008722 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

2408c7c6ed...22.exe

windows7-x64

2408c7c6ed...22.exe

windows10-2004-x64

3

Sharing

General

Target

2408c7c6edbe0c4468f33b5ff15d025ab40b2bc8f911da10b711cc5cf1008722
Size

482KB
Sample

221026-2d4rvahedr
MD5

110c9be4c49682a8b685fe9d1f73ab5c
SHA1

fdd1828aea33d5cd114646e4e462ad0996502a18
SHA256

2408c7c6edbe0c4468f33b5ff15d025ab40b2bc8f911da10b711cc5cf1008722
SHA512

9e20dc0d167075490c7e45a39e70854c96af962b0e5a7cddf6e0454cc3fc48198a9094715da8db91ffe6ad422181ed90426debff9c2bf469f9f76153243f243c
SSDEEP

6144:QegXa09mzcQQxXROmhbUOdWoSNYZEpCdIryEAjyFcUNcNB9ck5kSKIHJcO6CyJxY:QNQcROgbjWoSNTpCdIryErFVih5q4ezc

Score

10^/10

evasion persistence trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

2408c7c6edbe0c4468f33b5ff15d025ab40b2bc8f911da10b711cc5cf1008722.exe

Resource

win7-20220901-en

evasion persistence trojan upx

windows7-x64

20 signatures

600 seconds

Behavioral task

behavioral2

Sample

2408c7c6edbe0c4468f33b5ff15d025ab40b2bc8f911da10b711cc5cf1008722.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

1 signatures

600 seconds

Malware Config

Targets

- Target
  
  2408c7c6edbe0c4468f33b5ff15d025ab40b2bc8f911da10b711cc5cf1008722
- Size
  
  482KB
- MD5
  
  110c9be4c49682a8b685fe9d1f73ab5c
- SHA1
  
  fdd1828aea33d5cd114646e4e462ad0996502a18
- SHA256
  
  2408c7c6edbe0c4468f33b5ff15d025ab40b2bc8f911da10b711cc5cf1008722
- SHA512
  
  9e20dc0d167075490c7e45a39e70854c96af962b0e5a7cddf6e0454cc3fc48198a9094715da8db91ffe6ad422181ed90426debff9c2bf469f9f76153243f243c
- SSDEEP
  
  6144:QegXa09mzcQQxXROmhbUOdWoSNYZEpCdIryEAjyFcUNcNB9ck5kSKIHJcO6CyJxY:QNQcROgbjWoSNTpCdIryErFVih5q4ezc
Score

10^/10

evasion persistence trojan upx
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops startup file
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojanupx

behavioral2

© 2018-2025

Terms | Privacy