Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8

55f5bde691...fe.exe

windows7-x64

10

55f5bde691...fe.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    55f5bde691e69325bb2e8f7e7188d833a77c7686afc5b56ca7d457afc02424fe

  • Size

    8.9MB

  • Sample

    221202-a8dqcsge43

  • MD5

    684c4fc3683b5123a1ef42f92c6ef64c

  • SHA1

    4f804fc149d0f460c530ce4d2e8017c7d9987e48

  • SHA256

    55f5bde691e69325bb2e8f7e7188d833a77c7686afc5b56ca7d457afc02424fe

  • SHA512

    89e1d627bce754ee75fc85b774f074161b449d3a78bbf1c5506eac8d1173a97b23b0635cae9235fc3b09cfcb69eff3d857b19f3630282951c6bf3833931d74f8

  • SSDEEP

    196608:i7effIPEsy58doQaTzwZ8Jq3QKnqVtxQnKnqVtxQu9OryfEQncryfEQuWCLeybAZ:i7effIPEsy58doQaTzwZ8Jq3QKnqVtxy

Score
10/10
adwarepersistencestealerupx

Malware Config

Targets

    • Target

      55f5bde691e69325bb2e8f7e7188d833a77c7686afc5b56ca7d457afc02424fe

    • Size

      8.9MB

    • MD5

      684c4fc3683b5123a1ef42f92c6ef64c

    • SHA1

      4f804fc149d0f460c530ce4d2e8017c7d9987e48

    • SHA256

      55f5bde691e69325bb2e8f7e7188d833a77c7686afc5b56ca7d457afc02424fe

    • SHA512

      89e1d627bce754ee75fc85b774f074161b449d3a78bbf1c5506eac8d1173a97b23b0635cae9235fc3b09cfcb69eff3d857b19f3630282951c6bf3833931d74f8

    • SSDEEP

      196608:i7effIPEsy58doQaTzwZ8Jq3QKnqVtxQnKnqVtxQu9OryfEQncryfEQuWCLeybAZ:i7effIPEsy58doQaTzwZ8Jq3QKnqVtxy

    Score
    10/10
    adwarepersistencestealerupx

    • Modifies WinLogon for persistence

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks