Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

10c8eefdb8...89.exe

windows7-x64

10

10c8eefdb8...89.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10c8eefdb8344886070087f4522f92d33ee5cea76f0261fac60a5cb66354e689

  • Size

    2.0MB

  • Sample

    231114-xnbrladh26

  • MD5

    8e65ea65872f75ccfd39c9b3a976a4ea

  • SHA1

    da6db35943ca0c75cd7031495c40204fe3875ef9

  • SHA256

    10c8eefdb8344886070087f4522f92d33ee5cea76f0261fac60a5cb66354e689

  • SHA512

    b1c2e09595dbf8453310b5a547235965b86b2252db02ce1c6e0abe9017e844174c4596855ee3a414e9e49258651139624bb2e2900a92c3e839289b7580bc874b

  • SSDEEP

    6144:P3ve8ySm8hQAAIfFrRXuEE+0l97mKwKR6HVGI86JQPDHDdx/Qtqa:u/zkFF+EExZmKbReVzPJQPDHvd

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      10c8eefdb8344886070087f4522f92d33ee5cea76f0261fac60a5cb66354e689

    • Size

      2.0MB

    • MD5

      8e65ea65872f75ccfd39c9b3a976a4ea

    • SHA1

      da6db35943ca0c75cd7031495c40204fe3875ef9

    • SHA256

      10c8eefdb8344886070087f4522f92d33ee5cea76f0261fac60a5cb66354e689

    • SHA512

      b1c2e09595dbf8453310b5a547235965b86b2252db02ce1c6e0abe9017e844174c4596855ee3a414e9e49258651139624bb2e2900a92c3e839289b7580bc874b

    • SSDEEP

      6144:P3ve8ySm8hQAAIfFrRXuEE+0l97mKwKR6HVGI86JQPDHDdx/Qtqa:u/zkFF+EExZmKbReVzPJQPDHvd

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks