Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

f9230ed6f5...bd.exe

windows7-x64

8

f9230ed6f5...bd.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9230ed6f56e9698eaed425dab6a1252cd56e4cc769bea88eb627fa5d5b223bd

  • Size

    1.5MB

  • Sample

    221201-mxb4lsah67

  • MD5

    cb2e44fceaa9a4e6daa43c7f3a35b1af

  • SHA1

    b6b293334d0a40128c731fb9d8ec2137657ab6e5

  • SHA256

    f9230ed6f56e9698eaed425dab6a1252cd56e4cc769bea88eb627fa5d5b223bd

  • SHA512

    4724029b8c6459f6495800dcbc9459410d3cae5f855ca7cab70acdb7b86462016c58e1420dd84f995e18f2882dfa9441db05c183462a68e0636bd59100d6dbdb

  • SSDEEP

    24576:caeMqk4eF59tKhCvF7dnjgjxpP19f83OXXWYnR8ivQltND2NkSkIkyjL:caAHesCvFWlc3OWYRElKNk5IkyjL

Score
8/10
aspackv2persistence

Malware Config

Targets

    • Target

      f9230ed6f56e9698eaed425dab6a1252cd56e4cc769bea88eb627fa5d5b223bd

    • Size

      1.5MB

    • MD5

      cb2e44fceaa9a4e6daa43c7f3a35b1af

    • SHA1

      b6b293334d0a40128c731fb9d8ec2137657ab6e5

    • SHA256

      f9230ed6f56e9698eaed425dab6a1252cd56e4cc769bea88eb627fa5d5b223bd

    • SHA512

      4724029b8c6459f6495800dcbc9459410d3cae5f855ca7cab70acdb7b86462016c58e1420dd84f995e18f2882dfa9441db05c183462a68e0636bd59100d6dbdb

    • SSDEEP

      24576:caeMqk4eF59tKhCvF7dnjgjxpP19f83OXXWYnR8ivQltND2NkSkIkyjL:caAHesCvFWlc3OWYRElKNk5IkyjL

    Score
    8/10
    aspackv2persistence

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Modifies AppInit DLL entries

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks