Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

e730570424...7f.exe

windows7-x64

10

e730570424...7f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e73057042415637a8a4a0c6075de776a168e69229b91e2802f2d80946026437f

  • Size

    3.7MB

  • Sample

    221129-ec3f3acd57

  • MD5

    4cfcb3953f4f41537fa5d1306f8909ba

  • SHA1

    3039d358d22519f24021f53b01a511b61990505d

  • SHA256

    e73057042415637a8a4a0c6075de776a168e69229b91e2802f2d80946026437f

  • SHA512

    67e10cadceabcbd48deff0dbfe6ad294a3e084a64ef3f7bc25c4cfee1cf0d6ba43b8d03edeac80d12308abd4eac136174ef9abc74a86ec777b3d2b0f5d8c27ec

  • SSDEEP

    98304:HYua2oT/y2oHCoAqPinoaWBxazxTrTi2O:la2kF+pO96L

Score
10/10
bootkitevasionpersistence

Malware Config

Targets

    • Target

      e73057042415637a8a4a0c6075de776a168e69229b91e2802f2d80946026437f

    • Size

      3.7MB

    • MD5

      4cfcb3953f4f41537fa5d1306f8909ba

    • SHA1

      3039d358d22519f24021f53b01a511b61990505d

    • SHA256

      e73057042415637a8a4a0c6075de776a168e69229b91e2802f2d80946026437f

    • SHA512

      67e10cadceabcbd48deff0dbfe6ad294a3e084a64ef3f7bc25c4cfee1cf0d6ba43b8d03edeac80d12308abd4eac136174ef9abc74a86ec777b3d2b0f5d8c27ec

    • SSDEEP

      98304:HYua2oT/y2oHCoAqPinoaWBxazxTrTi2O:la2kF+pO96L

    Score
    10/10
    bootkitevasionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks