Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

05a7a349e3...97.exe

windows7-x64

10

05a7a349e3...97.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05a7a349e3cf602aa1b8f5162b5d82ecb2be9cab68186c1abf53bb38c132dd97

  • Size

    5.9MB

  • Sample

    231114-xjdemadb99

  • MD5

    64e7cd89bb30e3e4ff61954b1eaaa75c

  • SHA1

    f8d19c2493acf007b4dcb045501ef650d4d4a6c4

  • SHA256

    05a7a349e3cf602aa1b8f5162b5d82ecb2be9cab68186c1abf53bb38c132dd97

  • SHA512

    65fa366f0d34624f12feb02e2d0b9842488db8c4b7e85207b7f1c9f213f8c22301dbfdf2e5ea63d5bdee3deeec64d979b2c732c2a13c39cb2c8aeab6e24d2b34

  • SSDEEP

    12288:0XgvmzFHi0mo5aH0qMzd58lv7FVPJQPDHvd:0XgvOHi0mGaH0qSdaFn4V

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      05a7a349e3cf602aa1b8f5162b5d82ecb2be9cab68186c1abf53bb38c132dd97

    • Size

      5.9MB

    • MD5

      64e7cd89bb30e3e4ff61954b1eaaa75c

    • SHA1

      f8d19c2493acf007b4dcb045501ef650d4d4a6c4

    • SHA256

      05a7a349e3cf602aa1b8f5162b5d82ecb2be9cab68186c1abf53bb38c132dd97

    • SHA512

      65fa366f0d34624f12feb02e2d0b9842488db8c4b7e85207b7f1c9f213f8c22301dbfdf2e5ea63d5bdee3deeec64d979b2c732c2a13c39cb2c8aeab6e24d2b34

    • SSDEEP

      12288:0XgvmzFHi0mo5aH0qMzd58lv7FVPJQPDHvd:0XgvOHi0mGaH0qSdaFn4V

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks