Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

80a7dbee81...6d.exe

windows7-x64

10

80a7dbee81...6d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    29/02/2024, 08:59 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe

  • Size

    2.1MB

  • MD5

    36883a998e16240311949a43f5c1ecb7

  • SHA1

    50edc4c84eb8c15ab1653433700fce86af60f0b0

  • SHA256

    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d

  • SHA512

    c9321e31756ff0e2d4ff115293a4e44399ef8fcde3a470e0d7e989f107776a1d6c383f12815ea19d57820d39e94e4bbb40deae5d695ec5fa4e2d055fb59d95a0

  • SSDEEP

    49152:MwdhBkGMb18MLjRkRl+2HxYc0vFuvNX/oj6nPtI:MwdhBkGMb188jaz+2RY

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    "C:\Users\Admin\AppData\Local\Temp\80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • System policy modification
    PID:2348

Network

  • flag-us
    DNS
    raw.githubusercontent.com
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    Remote address:
    8.8.8.8:53
    Request
    raw.githubusercontent.com
    IN A
    Response
    raw.githubusercontent.com
    IN A
    185.199.108.133
    raw.githubusercontent.com
    IN A
    185.199.109.133
    raw.githubusercontent.com
    IN A
    185.199.110.133
    raw.githubusercontent.com
    IN A
    185.199.111.133
  • flag-us
    DNS
    haxlifec.ml
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    Remote address:
    8.8.8.8:53
    Request
    haxlifec.ml
    IN A
    Response
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    359 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    288 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    288 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    359 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    359 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    288 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    359 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    288 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    334 B
     219 B
     6
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    405 B
     219 B
     6
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    359 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    288 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    359 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    288 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    288 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    359 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    359 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    288 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    359 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    288 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    288 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    359 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    359 B
     219 B
     5
    5
  • 185.199.108.133:443
    raw.githubusercontent.com
    tls
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    288 B
     219 B
     5
    5
  • 8.8.8.8:53
    raw.githubusercontent.com
    dns
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    71 B
     135 B
     1
    1

    DNS Request

    raw.githubusercontent.com

    DNS Response

    185.199.108.133
    185.199.109.133
    185.199.110.133
    185.199.111.133

  • 8.8.8.8:53
    haxlifec.ml
    dns
    80a7dbee8158a3b6fde39bceceec0635c414145c069852a9047d06c124361d6d.exe
    57 B
     115 B
     1
    1

    DNS Request

    haxlifec.ml

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2348-2-0x0000000000400000-0x0000000000637000-memory.dmp

    Filesize

    2.2MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.