Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

9ecb68cb09...98.exe

windows7-x64

10

9ecb68cb09...98.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9ecb68cb09886f52d9ba0727017ef40414da821906c4925e7c559766fc2a7798

  • Size

    248KB

  • Sample

    221205-k56l3seb79

  • MD5

    badef9f09aef4c8a6dcf7733a07f6de6

  • SHA1

    3f688cfbd1bac714fdef18352b017e9998fa389d

  • SHA256

    9ecb68cb09886f52d9ba0727017ef40414da821906c4925e7c559766fc2a7798

  • SHA512

    9c83b1a6320b0ecb42e622c8bccf8d75c476e8ba365ab2bafd5a7aa038988b6665d06206e6b762b4d53fcef57bc8cf8a8082e333f1267492d2bfff71483af3df

  • SSDEEP

    6144:urG4eE4kqADEty4kHuEAXhXyzFyEAv/sJ5UB6+u5onKPU/c/FH98uuO2:uneE4kpgdkOEAXAFHyH/c/FH98

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      9ecb68cb09886f52d9ba0727017ef40414da821906c4925e7c559766fc2a7798

    • Size

      248KB

    • MD5

      badef9f09aef4c8a6dcf7733a07f6de6

    • SHA1

      3f688cfbd1bac714fdef18352b017e9998fa389d

    • SHA256

      9ecb68cb09886f52d9ba0727017ef40414da821906c4925e7c559766fc2a7798

    • SHA512

      9c83b1a6320b0ecb42e622c8bccf8d75c476e8ba365ab2bafd5a7aa038988b6665d06206e6b762b4d53fcef57bc8cf8a8082e333f1267492d2bfff71483af3df

    • SSDEEP

      6144:urG4eE4kqADEty4kHuEAXhXyzFyEAv/sJ5UB6+u5onKPU/c/FH98uuO2:uneE4kpgdkOEAXAFHyH/c/FH98

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks