0606b4e4dea64c05a6b041dbc2a50276e02efa9fcd194e2d895c1dec9d3d266a | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

0606b4e4de...6a.exe

windows7-x64

0606b4e4de...6a.exe

windows10-2004-x64

8

Sharing

General

Target

0606b4e4dea64c05a6b041dbc2a50276e02efa9fcd194e2d895c1dec9d3d266a
Size

205KB
Sample

221126-3scgksdf62
MD5

6eae993ff5f359c8796199027c009b58
SHA1

f346b43723d8bcad06fc93b203f3663aff1df039
SHA256

0606b4e4dea64c05a6b041dbc2a50276e02efa9fcd194e2d895c1dec9d3d266a
SHA512

3c07b2baa988c6d095af1a158bb04381b941f16db8b470ddb01fe3600857dfb10d3e143716215f1c18f21841b356c3ca931e563c2eca07f885d37b08af09c7c9
SSDEEP

3072:hqhMPssRhlARSOsdwD/98out3SDADeak7dJHB/AKG:hqhMPssRARoiSoS3SsQLH5AK

Score

10^/10

evasion persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

0606b4e4dea64c05a6b041dbc2a50276e02efa9fcd194e2d895c1dec9d3d266a.exe

Resource

win7-20221111-en

evasion persistence trojan

windows7-x64

24 signatures

150 seconds

Behavioral task

behavioral2

Sample

0606b4e4dea64c05a6b041dbc2a50276e02efa9fcd194e2d895c1dec9d3d266a.exe

Resource

win10v2004-20221111-en

windows10-2004-x64

4 signatures

150 seconds

Malware Config

Targets

- Target
  
  0606b4e4dea64c05a6b041dbc2a50276e02efa9fcd194e2d895c1dec9d3d266a
- Size
  
  205KB
- MD5
  
  6eae993ff5f359c8796199027c009b58
- SHA1
  
  f346b43723d8bcad06fc93b203f3663aff1df039
- SHA256
  
  0606b4e4dea64c05a6b041dbc2a50276e02efa9fcd194e2d895c1dec9d3d266a
- SHA512
  
  3c07b2baa988c6d095af1a158bb04381b941f16db8b470ddb01fe3600857dfb10d3e143716215f1c18f21841b356c3ca931e563c2eca07f885d37b08af09c7c9
- SSDEEP
  
  3072:hqhMPssRhlARSOsdwD/98out3SDADeak7dJHB/AKG:hqhMPssRARoiSoS3SsQLH5AK
Score

10^/10

evasion persistence trojan
- Modifies WinLogon for persistence
  persistence
- Modifies system executable filetype association
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

Hidden Files and Directories

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

© 2018-2025

Terms | Privacy