Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

f9c5420c0f...b9.exe

windows7-x64

10

f9c5420c0f...b9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9c5420c0f039a178f5495ecfb657f8da383624e0cf7f02c645fbdfa95e2e8b9.zip

  • Size

    143KB

  • Sample

    230311-q2m88abf5x

  • MD5

    86737721f1af3bef22c4cac9c6de1a6a

  • SHA1

    ac4761d89c27069133d0973ad6c0482ecbbd4470

  • SHA256

    7da10be7c1f7da766219ac0bb0cd772e65b8d0881561ae02c42d5dd1a94f982d

  • SHA512

    dc0e8c0ce5b76650cf3fd89aab038d970809d46c5d70f05b266e04093d4bb928ece0db0df153d1fc9f228ffade11914b9f0a1843c434cba3015b283da56e3476

  • SSDEEP

    3072:C5BScNHH46PPoTeHLkk9s5j+WOWqgbnhKRypw6NauwANECRtQ5B2O4jqQwUeGVJU:uBtHH4Wbu5SIbI/6fzOCRtQ5B2Ok3eZ

Score
10/10
mimikatzdiscoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      f9c5420c0f039a178f5495ecfb657f8da383624e0cf7f02c645fbdfa95e2e8b9.exe

    • Size

      149KB

    • MD5

      7d8f0e539e50eb545d094c50aab0ea9e

    • SHA1

      9368da690ace5328abc4461cd8322d78c1fdc290

    • SHA256

      f9c5420c0f039a178f5495ecfb657f8da383624e0cf7f02c645fbdfa95e2e8b9

    • SHA512

      092d05eb357da75c2a6646a353e1c1cf7f0ae66ea32ac4beff8fda87160c9226417b187b4ac34e7b5745aaa65c8a6b8b33b9f02e19d9a959627544b50a3eae7a

    • SSDEEP

      3072:Pmpq7ybSPGccu5R9Wl7rSmpVYc7+DUltw/ArIW1:epqG2eM5R9kNj2UlgJ

    Score
    10/10
    discoveryevasionpersistenceupxmimikatz

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • Modifies WinLogon for persistence

      persistence

    • mimikatz is an open source tool to dump credentials on Windows

    • Contacts a large (837) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks