Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

8d3f622b89...JC.exe

windows7-x64

10

8d3f622b89...JC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8d3f622b8952892016c0b582c33687d8_JC.exe

  • Size

    704KB

  • Sample

    230930-n8y8ysbd81

  • MD5

    8d3f622b8952892016c0b582c33687d8

  • SHA1

    9d1e76efcb39695a5ee663e69e567848a719176d

  • SHA256

    bc704212e1f9c40781d39d0a9e2ebc5a261ae228d3b3d8705e170d65b69daba2

  • SHA512

    53c7c8b96a3756f0c94558cbf6dc0cf80438f20275a31db349a2bddab660f453c80b767f8d24ef2128bfedc68401c2963dbbade6c45c5bf945bdfa92647d0873

  • SSDEEP

    12288:VXgvmzFHi0mo5aH0qMzd5807FyPJQPDHvd:VXgvOHi0mGaH0qSdPFM4V

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      8d3f622b8952892016c0b582c33687d8_JC.exe

    • Size

      704KB

    • MD5

      8d3f622b8952892016c0b582c33687d8

    • SHA1

      9d1e76efcb39695a5ee663e69e567848a719176d

    • SHA256

      bc704212e1f9c40781d39d0a9e2ebc5a261ae228d3b3d8705e170d65b69daba2

    • SHA512

      53c7c8b96a3756f0c94558cbf6dc0cf80438f20275a31db349a2bddab660f453c80b767f8d24ef2128bfedc68401c2963dbbade6c45c5bf945bdfa92647d0873

    • SSDEEP

      12288:VXgvmzFHi0mo5aH0qMzd5807FyPJQPDHvd:VXgvOHi0mGaH0qSdPFM4V

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks