Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    879KB

  • Sample

    221223-3avkface6s

  • MD5

    45f6980ec4c0108bb1103cbc1906fa18

  • SHA1

    26504d9884c97a2fab9aa128148a5b36becf9e92

  • SHA256

    8bc19641f9095f8c86c3836cf1f9d7b1dd14a1c62da0320ce09d5e27d0104927

  • SHA512

    64fc21f11fc4bfbd485111695ee2ac9e1e70f4107893e259aa4d705a7ad647e7968f3c223d8d647124c8b0d8f041bae074c600a0ae168b0eb166cd62ee877049

  • SSDEEP

    24576:Cubv+5jv8LiSo2Jbqok9WYik0km7tm/78IM6lnI:CahLiSo2JbqXFikY0gIM6lnI

Score
10/10
chinese_generic_botnetbotnetpersistence

Malware Config

Targets

    • Target

      file.exe

    • Size

      879KB

    • MD5

      45f6980ec4c0108bb1103cbc1906fa18

    • SHA1

      26504d9884c97a2fab9aa128148a5b36becf9e92

    • SHA256

      8bc19641f9095f8c86c3836cf1f9d7b1dd14a1c62da0320ce09d5e27d0104927

    • SHA512

      64fc21f11fc4bfbd485111695ee2ac9e1e70f4107893e259aa4d705a7ad647e7968f3c223d8d647124c8b0d8f041bae074c600a0ae168b0eb166cd62ee877049

    • SSDEEP

      24576:Cubv+5jv8LiSo2Jbqok9WYik0km7tm/78IM6lnI:CahLiSo2JbqXFikY0gIM6lnI

    Score
    10/10
    chinese_generic_botnetbotnetpersistence

    • Generic Chinese Botnet

      A botnet originating from China which is currently unnamed publicly.

      botnetchinese_generic_botnet

    • Chinese Botnet payload

      botnet

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks