Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

3uTools_v2...up.exe

windows7-x64

1

3uTools_v2...up.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3uTools_v2.65.003_Setup.exe

  • Size

    115.8MB

  • Sample

    230704-t1pbnsha6y

  • MD5

    a23cf91ca5adf1828ea3e8a94250adba

  • SHA1

    32903059c9c5cb6aadcad3c04c7d4b98f7e5815f

  • SHA256

    84f885bf443d5070412cb86c1c49b22963e65187000ba665c12b3c623ab59951

  • SHA512

    81484d2ae7e6b35ddebedcdcb526d43ebbde3606635c5c1e4f299692f1c9041e7e04d56cf279b43402152533c83791fd7decad7249d298ae56969db638c8ef4f

  • SSDEEP

    3145728:4kOygLs+m7VOGETTYF6ObUNihj/TU49UQLhWGSfVRDX8QGJ/oEE8sVa:UygTwOGT7EchL0RDXvswEE2

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      3uTools_v2.65.003_Setup.exe

    • Size

      115.8MB

    • MD5

      a23cf91ca5adf1828ea3e8a94250adba

    • SHA1

      32903059c9c5cb6aadcad3c04c7d4b98f7e5815f

    • SHA256

      84f885bf443d5070412cb86c1c49b22963e65187000ba665c12b3c623ab59951

    • SHA512

      81484d2ae7e6b35ddebedcdcb526d43ebbde3606635c5c1e4f299692f1c9041e7e04d56cf279b43402152533c83791fd7decad7249d298ae56969db638c8ef4f

    • SSDEEP

      3145728:4kOygLs+m7VOGETTYF6ObUNihj/TU49UQLhWGSfVRDX8QGJ/oEE8sVa:UygTwOGT7EchL0RDXvswEE2

    Score
    8/10
    discoverypersistence

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Modifies file permissions

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks