Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8

29ce06feb1...88.exe

windows7-x64

10

29ce06feb1...88.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    29ce06feb138c8a032cb103623affc4d2c55e78cbf07f32c035ef7ef1a35cd88

  • Size

    693KB

  • Sample

    221128-cj863sfg46

  • MD5

    e4540200b9618a0e460c3ffc4373c6c2

  • SHA1

    07757e76942afbef15c6dcb05d1eb0b95f2ba659

  • SHA256

    29ce06feb138c8a032cb103623affc4d2c55e78cbf07f32c035ef7ef1a35cd88

  • SHA512

    a7a0f6c50bb1cbe21371cd397c78ec594f81261442cc8609d7290601a8b17e432f69762d5cbeb07313fd340b9b7ed466ca1df016583af107e5da7af5f942b8ed

  • SSDEEP

    1536:cd04boUzdIBsZUpUQSe1sjL/91IqmM4nouy8:cdJboUpEsueFssP11I5Mwout

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Targets

    • Target

      29ce06feb138c8a032cb103623affc4d2c55e78cbf07f32c035ef7ef1a35cd88

    • Size

      693KB

    • MD5

      e4540200b9618a0e460c3ffc4373c6c2

    • SHA1

      07757e76942afbef15c6dcb05d1eb0b95f2ba659

    • SHA256

      29ce06feb138c8a032cb103623affc4d2c55e78cbf07f32c035ef7ef1a35cd88

    • SHA512

      a7a0f6c50bb1cbe21371cd397c78ec594f81261442cc8609d7290601a8b17e432f69762d5cbeb07313fd340b9b7ed466ca1df016583af107e5da7af5f942b8ed

    • SSDEEP

      1536:cd04boUzdIBsZUpUQSe1sjL/91IqmM4nouy8:cdJboUpEsueFssP11I5Mwout

    Score
    10/10
    evasionpersistencespywarestealertrojanupx

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks