Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

efd98ea53d...70.exe

windows7-x64

10

efd98ea53d...70.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

  • Size

    524KB

  • Sample

    221204-qyfd7sdd88

  • MD5

    f2bee96df56e120e5496568a17919a38

  • SHA1

    48177f9e7e03b5c719032eca70164009629906d6

  • SHA256

    efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

  • SHA512

    23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

  • SSDEEP

    6144:GEIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUSCnDU:GEIXsgtvm1De5YlOx6lzBH46Ut4

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

    • Size

      524KB

    • MD5

      f2bee96df56e120e5496568a17919a38

    • SHA1

      48177f9e7e03b5c719032eca70164009629906d6

    • SHA256

      efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

    • SHA512

      23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

    • SSDEEP

      6144:GEIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUSCnDU:GEIXsgtvm1De5YlOx6lzBH46Ut4

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks