Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8

c0d2835ed1...6c.exe

windows7-x64

10

c0d2835ed1...6c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c0d2835ed1ba24be8bc7822f7a4dc065730952cf829bc8ec53efd52c4a8ec96c

  • Size

    70KB

  • Sample

    221203-m7vnpsea32

  • MD5

    8f85727a9c588760c35b07e5b8fdef95

  • SHA1

    6e868ad886e80b77917ed4d6533f1cf532c4501a

  • SHA256

    c0d2835ed1ba24be8bc7822f7a4dc065730952cf829bc8ec53efd52c4a8ec96c

  • SHA512

    2645b820a7e1a04353553895add314052fc791eb8e4e6ac10adfff010b9438b27e9b4c1b02b9f089044d532ed42237b4ff388cec256cbfdb58baca621e929ddb

  • SSDEEP

    1536:rXDZWlNkY/NAfA74SLLz283tkAz857lqjFmM1xd7AZ/BV9Qbg:rX1WlVCBsX9PMEBc1l

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      c0d2835ed1ba24be8bc7822f7a4dc065730952cf829bc8ec53efd52c4a8ec96c

    • Size

      70KB

    • MD5

      8f85727a9c588760c35b07e5b8fdef95

    • SHA1

      6e868ad886e80b77917ed4d6533f1cf532c4501a

    • SHA256

      c0d2835ed1ba24be8bc7822f7a4dc065730952cf829bc8ec53efd52c4a8ec96c

    • SHA512

      2645b820a7e1a04353553895add314052fc791eb8e4e6ac10adfff010b9438b27e9b4c1b02b9f089044d532ed42237b4ff388cec256cbfdb58baca621e929ddb

    • SSDEEP

      1536:rXDZWlNkY/NAfA74SLLz283tkAz857lqjFmM1xd7AZ/BV9Qbg:rX1WlVCBsX9PMEBc1l

    Score
    10/10
    evasionpersistenceupx

    • Modifies system executable filetype association

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops startup file

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks