Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

[FTUApps.C...ed.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    [FTUApps.Com] VMware Workstation 17.0.0-20800274 PreActivated.exe

  • Size

    517.3MB

  • Sample

    230612-xbgr3sdc82

  • MD5

    31d1acc522672b90ef71642bc4c161cd

  • SHA1

    8249533537dfa09779aa85f26582e5eb9ba9ab98

  • SHA256

    70e1416c1a639b3384bcbbf7930c4c7e790c6b060fb2e71b133ddef15e97bc56

  • SHA512

    b0b4b90eff4059b661290d8fd3e84b55df82eb9eca96c923a4010021f82bca0430345f06c27bd3938be4edc53a6985f49af26d6b2a8e32a0eaf0a7a847b121a0

  • SSDEEP

    12582912:05YFWLtA1Rz1m5ILg8zJIi7FbXNcl1iO+TvaD/3pHRZp8w3nzhfPU0wkwY2:05YwcDMx81n7JQ1z+I3pH/OSg3d

Score
9/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      [FTUApps.Com] VMware Workstation 17.0.0-20800274 PreActivated.exe

    • Size

      517.3MB

    • MD5

      31d1acc522672b90ef71642bc4c161cd

    • SHA1

      8249533537dfa09779aa85f26582e5eb9ba9ab98

    • SHA256

      70e1416c1a639b3384bcbbf7930c4c7e790c6b060fb2e71b133ddef15e97bc56

    • SHA512

      b0b4b90eff4059b661290d8fd3e84b55df82eb9eca96c923a4010021f82bca0430345f06c27bd3938be4edc53a6985f49af26d6b2a8e32a0eaf0a7a847b121a0

    • SSDEEP

      12582912:05YFWLtA1Rz1m5ILg8zJIi7FbXNcl1iO+TvaD/3pHRZp8w3nzhfPU0wkwY2:05YwcDMx81n7JQ1z+I3pH/OSg3d

    Score
    9/10
    discoveryevasionpersistence

    • Detect jar appended to MSI

    • Drops file in Drivers directory

    • Looks for VMWare Tools registry key

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks