181fb1aa80205a7ec9ca50fb02f4c0a5d3c22fa78a974f20ef5c4559e4937850 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

8

181fb1aa80...50.exe

windows7-x64

181fb1aa80...50.exe

windows10-2004-x64

Sharing

General

Target

181fb1aa80205a7ec9ca50fb02f4c0a5d3c22fa78a974f20ef5c4559e4937850
Size

9.1MB
Sample

221202-a8jxdabh8x
MD5

aaa585f29635d03b33aab4180b386665
SHA1

97d7eb0712cdaf1cb93b80a4e027285bb5cf5583
SHA256

181fb1aa80205a7ec9ca50fb02f4c0a5d3c22fa78a974f20ef5c4559e4937850
SHA512

83cac084e64b0a494b1063dfe6ee6be4298db70ecb4df5c239c56309c92edb1342e371b93a64346f9692c1af72f008dff9b78cae0f29101330e8027138db3d14
SSDEEP

196608:i7effIPEsy58doQaTxLhQyZbIly38doQalArdfehQM2gsyVCQlXlAryfEQulen8u:i7effIPEsy58doQaTxLhQyZbIly38dob

Score

10^/10

adware persistence stealer upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

181fb1aa80205a7ec9ca50fb02f4c0a5d3c22fa78a974f20ef5c4559e4937850.exe

Resource

win7-20220812-en

adware persistence stealer upx

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

181fb1aa80205a7ec9ca50fb02f4c0a5d3c22fa78a974f20ef5c4559e4937850.exe

Resource

win10v2004-20220812-en

adware persistence stealer upx

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  181fb1aa80205a7ec9ca50fb02f4c0a5d3c22fa78a974f20ef5c4559e4937850
- Size
  
  9.1MB
- MD5
  
  aaa585f29635d03b33aab4180b386665
- SHA1
  
  97d7eb0712cdaf1cb93b80a4e027285bb5cf5583
- SHA256
  
  181fb1aa80205a7ec9ca50fb02f4c0a5d3c22fa78a974f20ef5c4559e4937850
- SHA512
  
  83cac084e64b0a494b1063dfe6ee6be4298db70ecb4df5c239c56309c92edb1342e371b93a64346f9692c1af72f008dff9b78cae0f29101330e8027138db3d14
- SSDEEP
  
  196608:i7effIPEsy58doQaTxLhQyZbIly38doQalArdfehQM2gsyVCQlXlAryfEQulen8u:i7effIPEsy58doQaTxLhQyZbIly38dob
Score

10^/10

adware persistence stealer upx
- Modifies WinLogon for persistence
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Drops file in Drivers directory
- Sets service image path in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarepersistencestealerupx

behavioral2

adwarepersistencestealerupx

© 2018-2025

Terms | Privacy