Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

0de805cfde...73.exe

windows7-x64

10

0de805cfde...73.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73

  • Size

    26.5MB

  • Sample

    231114-xjyessee6t

  • MD5

    970f1757ccc0b60859d23302688359ee

  • SHA1

    bbe7be423ba59b0e9872d4f8556b8a9f89d46204

  • SHA256

    0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73

  • SHA512

    ca1e1b4a018c730391b90b7b235932bc87b1aa331c1c8327d1aa510cb0c6eb49e7ed110703ae8b2c41e54c1f066d51fa691aff3e09c5cc7a22c3195bce23ff47

  • SSDEEP

    6144:O3Te8ySm8hQAAIfFrRXuEE+0l97mKwKArOHV3j86JQPDHDdx/Qtqa:B/zkFF+EExZmKbciVTPJQPDHvd

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73

    • Size

      26.5MB

    • MD5

      970f1757ccc0b60859d23302688359ee

    • SHA1

      bbe7be423ba59b0e9872d4f8556b8a9f89d46204

    • SHA256

      0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73

    • SHA512

      ca1e1b4a018c730391b90b7b235932bc87b1aa331c1c8327d1aa510cb0c6eb49e7ed110703ae8b2c41e54c1f066d51fa691aff3e09c5cc7a22c3195bce23ff47

    • SSDEEP

      6144:O3Te8ySm8hQAAIfFrRXuEE+0l97mKwKArOHV3j86JQPDHDdx/Qtqa:B/zkFF+EExZmKbciVTPJQPDHvd

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks