Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1978b6cdf7...88.exe

windows7-x64

10

1978b6cdf7...88.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1978b6cdf7b474f443bfc551fc0bbf9f46073fc4c336b63743d0dbc1fb19e188

  • Size

    612KB

  • Sample

    221107-ke4pssadhk

  • MD5

    0d195b53275f39314a7a56846e3fc090

  • SHA1

    93c21a50f6b3ecf0e3e807117e307568af1e7ed0

  • SHA256

    1978b6cdf7b474f443bfc551fc0bbf9f46073fc4c336b63743d0dbc1fb19e188

  • SHA512

    e30b61fcc06adb06f0d60393fb881e7556d4b151c9ec9b45860688370a80fc8cab4e47e9c252daacbfa9fc3233e3819d30189c9334e3f83fce255f70dcd2757d

  • SSDEEP

    12288:agkDxdkL+6JNgKVcRa+fpHyWs3OBH4pUCiDjyGWCaz/Fu6r:kxsKXa+hHyWseBglPGWCObr

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      1978b6cdf7b474f443bfc551fc0bbf9f46073fc4c336b63743d0dbc1fb19e188

    • Size

      612KB

    • MD5

      0d195b53275f39314a7a56846e3fc090

    • SHA1

      93c21a50f6b3ecf0e3e807117e307568af1e7ed0

    • SHA256

      1978b6cdf7b474f443bfc551fc0bbf9f46073fc4c336b63743d0dbc1fb19e188

    • SHA512

      e30b61fcc06adb06f0d60393fb881e7556d4b151c9ec9b45860688370a80fc8cab4e47e9c252daacbfa9fc3233e3819d30189c9334e3f83fce255f70dcd2757d

    • SSDEEP

      12288:agkDxdkL+6JNgKVcRa+fpHyWs3OBH4pUCiDjyGWCaz/Fu6r:kxsKXa+hHyWseBglPGWCObr

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks