fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

1

winprofile

windows7-x64

9

winprofile

windows10-1703-x64

9

Sharing

General

Target

fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c
Size

3.4MB
Sample

230315-f2j7fsbf97
MD5

c15dcae56336f681ea1dd5aad33bb62b
SHA1

dec7bdfc4c06c2f1475e9159916da6fd05c7fc36
SHA256

fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c
SHA512

4e799450778e10b009e9e81771537b24d05a52cc6799ec869e46327f07b0d68acd478156c4370947aac11e55f69483f422c3f5a00baa878588001fe10c8e2e7b
SSDEEP

49152:onrbOKMFrJmsf6/HAv4fVCnoYcNmCCyQaxfrLkWUhsZz2RNRenjqc4i3PHkVgXIf:YaEU6/HWQ4noYOCtapQX9ejqcT3/SgYf

Score

9^/10

discovery evasion trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe

Resource

win7-20230220-en

discovery evasion trojan upx

windows7-x64

10 signatures

300 seconds

Behavioral task

behavioral2

Sample

fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe

Resource

win10-20230220-en

discovery evasion trojan upx

windows10-1703-x64

9 signatures

300 seconds

Malware Config

Targets

- Target
  
  fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c
- Size
  
  3.4MB
- MD5
  
  c15dcae56336f681ea1dd5aad33bb62b
- SHA1
  
  dec7bdfc4c06c2f1475e9159916da6fd05c7fc36
- SHA256
  
  fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c
- SHA512
  
  4e799450778e10b009e9e81771537b24d05a52cc6799ec869e46327f07b0d68acd478156c4370947aac11e55f69483f422c3f5a00baa878588001fe10c8e2e7b
- SSDEEP
  
  49152:onrbOKMFrJmsf6/HAv4fVCnoYcNmCCyQaxfrLkWUhsZz2RNRenjqc4i3PHkVgXIf:YaEU6/HWQ4noYOCtapQX9ejqcT3/SgYf
Score

9^/10

discovery evasion trojan upx
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasiontrojanupx

behavioral2

discoveryevasiontrojanupx

© 2018-2025

Terms | Privacy