Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

c0444aa8c3...c9.exe

windows7-x64

8

c0444aa8c3...c9.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c0444aa8c343a5c221eefac21fc4e3351d33e2d88dcb0c594607a8183e0ffec9

  • Size

    2.4MB

  • Sample

    221206-rc34tagg9y

  • MD5

    a1d81bb6ab3d1f86cca94e5b8d1d3d37

  • SHA1

    26a0e87725b16cb9f596bd95efb00806889665da

  • SHA256

    c0444aa8c343a5c221eefac21fc4e3351d33e2d88dcb0c594607a8183e0ffec9

  • SHA512

    c94b35b3dd64ee66d4e7326c85655e29df87def5062a88fd3a84841ac595be0d33bf2d3ac7a86859715f4c52fd3e80353fefccf09a4292a0651517234011182a

  • SSDEEP

    49152:VqTmJkMbVZhS9l9etTaT0gktfLheuGrm5okVqAz8fL6pOG:VCIirstTK6ePq5iAe6gG

Score
8/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      c0444aa8c343a5c221eefac21fc4e3351d33e2d88dcb0c594607a8183e0ffec9

    • Size

      2.4MB

    • MD5

      a1d81bb6ab3d1f86cca94e5b8d1d3d37

    • SHA1

      26a0e87725b16cb9f596bd95efb00806889665da

    • SHA256

      c0444aa8c343a5c221eefac21fc4e3351d33e2d88dcb0c594607a8183e0ffec9

    • SHA512

      c94b35b3dd64ee66d4e7326c85655e29df87def5062a88fd3a84841ac595be0d33bf2d3ac7a86859715f4c52fd3e80353fefccf09a4292a0651517234011182a

    • SSDEEP

      49152:VqTmJkMbVZhS9l9etTaT0gktfLheuGrm5okVqAz8fL6pOG:VCIirstTK6ePq5iAe6gG

    Score
    8/10
    evasionpersistencetrojan

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks