Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

12af93d290...9d.dll

windows7-x64

10

12af93d290...9d.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12af93d29007b28f8e5cd5db210de0b91e0e84ca318893a79d0efc11f813fb9d

  • Size

    256KB

  • Sample

    221205-qnx69sgh5x

  • MD5

    5129a643720990da5ac6f1d0d7bd4181

  • SHA1

    57cd9af7745ee0e4b68124bbb8851964d1653cd0

  • SHA256

    12af93d29007b28f8e5cd5db210de0b91e0e84ca318893a79d0efc11f813fb9d

  • SHA512

    9553055fa78c86fd7e51f3bc1454bd7b9aa59a0dc4a25a8e660fbd7a62861b7ca066b52f4d67980e06b487c30695f8a4a9deecbed6a17bb8d664d81bec05bfcb

  • SSDEEP

    3072:54vRJRkTcZ7fcxdl5CTqBoEBClwrnfJMtZbzOPrLRiwte9I1yi5fEB1msmU580Xs:5OHngrYuyRmsm28KJ0I7

Score
10/10
ramnitbankerevasionpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      12af93d29007b28f8e5cd5db210de0b91e0e84ca318893a79d0efc11f813fb9d

    • Size

      256KB

    • MD5

      5129a643720990da5ac6f1d0d7bd4181

    • SHA1

      57cd9af7745ee0e4b68124bbb8851964d1653cd0

    • SHA256

      12af93d29007b28f8e5cd5db210de0b91e0e84ca318893a79d0efc11f813fb9d

    • SHA512

      9553055fa78c86fd7e51f3bc1454bd7b9aa59a0dc4a25a8e660fbd7a62861b7ca066b52f4d67980e06b487c30695f8a4a9deecbed6a17bb8d664d81bec05bfcb

    • SSDEEP

      3072:54vRJRkTcZ7fcxdl5CTqBoEBClwrnfJMtZbzOPrLRiwte9I1yi5fEB1msmU580Xs:5OHngrYuyRmsm28KJ0I7

    Score
    10/10
    ramnitbankerevasionpersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks