Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

b7138253b4...f3.exe

windows7-x64

10

b7138253b4...f3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b7138253b4ebe17bcd38cfd48f8ee20f096588a42ad36922cf8fce4e187088f3

  • Size

    564KB

  • Sample

    221030-ramdaaddc7

  • MD5

    83f33c91469fc991bbc584015ab497c3

  • SHA1

    1f53eb45b325b0868f1ba0bacef2533ea10a7fea

  • SHA256

    b7138253b4ebe17bcd38cfd48f8ee20f096588a42ad36922cf8fce4e187088f3

  • SHA512

    065e0133b35dfad3360b6d6bcbc1fc609c38d872c0352d3d40354baf36bc9666e286ec4b5d694f42edb0e112fe39a9b29e788d03abd70c1ee064bd972cf1c8e9

  • SSDEEP

    12288:qmaNhOPnxBnHkapLjTn/rhlUy1WotA7dM9BAYdNUGotp0:qCBnHZpLHrtWotkC/Ubp0

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      b7138253b4ebe17bcd38cfd48f8ee20f096588a42ad36922cf8fce4e187088f3

    • Size

      564KB

    • MD5

      83f33c91469fc991bbc584015ab497c3

    • SHA1

      1f53eb45b325b0868f1ba0bacef2533ea10a7fea

    • SHA256

      b7138253b4ebe17bcd38cfd48f8ee20f096588a42ad36922cf8fce4e187088f3

    • SHA512

      065e0133b35dfad3360b6d6bcbc1fc609c38d872c0352d3d40354baf36bc9666e286ec4b5d694f42edb0e112fe39a9b29e788d03abd70c1ee064bd972cf1c8e9

    • SSDEEP

      12288:qmaNhOPnxBnHkapLjTn/rhlUy1WotA7dM9BAYdNUGotp0:qCBnHZpLHrtWotkC/Ubp0

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks