c7729bf3060b55c76e0b85ead974496a2f14555691162fbbc509f3f612c67458 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

c7729bf306...58.exe

windows7-x64

c7729bf306...58.exe

windows10-2004-x64

3

Sharing

General

Target

c7729bf3060b55c76e0b85ead974496a2f14555691162fbbc509f3f612c67458
Size

556KB
Sample

221129-gp1jcafb61
MD5

f0039c9f1087c3fed31648bf39a71d7c
SHA1

1c7090581e7ee33f016e001cef38a3f383d0f7f8
SHA256

c7729bf3060b55c76e0b85ead974496a2f14555691162fbbc509f3f612c67458
SHA512

9cd088e69a3a919b2ae98dc43d9c441e6adda7bd335019ebdb066f8dad8b1598fc099b5514ad4b7a42496170dc2a5f6d761b4e1c04326c06a3f9d9552d0e7ae6
SSDEEP

12288:X6bvdl0zCB8EDItMTzwg7lMQsvNuqZBRbZEYTwdD7IjLgnx:4vdezCByqTtlMQsFuqzRbzI7Iy

Score

10^/10

evasion persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

c7729bf3060b55c76e0b85ead974496a2f14555691162fbbc509f3f612c67458.exe

Resource

win7-20220812-en

evasion persistence trojan

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

c7729bf3060b55c76e0b85ead974496a2f14555691162fbbc509f3f612c67458.exe

Resource

win10v2004-20221111-en

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Targets

- Target
  
  c7729bf3060b55c76e0b85ead974496a2f14555691162fbbc509f3f612c67458
- Size
  
  556KB
- MD5
  
  f0039c9f1087c3fed31648bf39a71d7c
- SHA1
  
  1c7090581e7ee33f016e001cef38a3f383d0f7f8
- SHA256
  
  c7729bf3060b55c76e0b85ead974496a2f14555691162fbbc509f3f612c67458
- SHA512
  
  9cd088e69a3a919b2ae98dc43d9c441e6adda7bd335019ebdb066f8dad8b1598fc099b5514ad4b7a42496170dc2a5f6d761b4e1c04326c06a3f9d9552d0e7ae6
- SSDEEP
  
  12288:X6bvdl0zCB8EDItMTzwg7lMQsvNuqZBRbZEYTwdD7IjLgnx:4vdezCByqTtlMQsFuqzRbzI7Iy
Score

10^/10

evasion persistence trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Disables RegEdit via registry modification
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

© 2018-2025

Terms | Privacy