546d87eba6087a4eafa14149fc5963500dddd3f720637e8bd6e8a2bd949d1350 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

546d87eba6...50.exe

windows7-x64

546d87eba6...50.exe

windows10-2004-x64

Sharing

General

Target

546d87eba6087a4eafa14149fc5963500dddd3f720637e8bd6e8a2bd949d1350
Size

527KB
Sample

240307-ysf3jsdd6w
MD5

d2a84cd7cb1e7c8a63820f030753a8f5
SHA1

15d0538bc7013357e897f02c7e2175c122b2e826
SHA256

546d87eba6087a4eafa14149fc5963500dddd3f720637e8bd6e8a2bd949d1350
SHA512

de53165cb051c841207371ab0a05a1a69f9aadced101c419e3bb83f167da69ab1c1e1e524d1bf20573ae99f41490ed3f66afeaac6a6bf8367613947607c4c51e
SSDEEP

12288:gQ+Qu9yus9exo/2oweeKie/fU94i8Z3D+RXseaj9Mav:8I9exo/2TeeKie/fe4i8ZQseaj9Mav

Score

10^/10

adware persistence stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

546d87eba6087a4eafa14149fc5963500dddd3f720637e8bd6e8a2bd949d1350.exe

Resource

win7-20240215-en

adware persistence stealer

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

546d87eba6087a4eafa14149fc5963500dddd3f720637e8bd6e8a2bd949d1350.exe

Resource

win10v2004-20240226-en

adware persistence stealer

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  546d87eba6087a4eafa14149fc5963500dddd3f720637e8bd6e8a2bd949d1350
- Size
  
  527KB
- MD5
  
  d2a84cd7cb1e7c8a63820f030753a8f5
- SHA1
  
  15d0538bc7013357e897f02c7e2175c122b2e826
- SHA256
  
  546d87eba6087a4eafa14149fc5963500dddd3f720637e8bd6e8a2bd949d1350
- SHA512
  
  de53165cb051c841207371ab0a05a1a69f9aadced101c419e3bb83f167da69ab1c1e1e524d1bf20573ae99f41490ed3f66afeaac6a6bf8367613947607c4c51e
- SSDEEP
  
  12288:gQ+Qu9yus9exo/2oweeKie/fU94i8Z3D+RXseaj9Mav:8I9exo/2TeeKie/fe4i8ZQseaj9Mav
Score

10^/10

adware persistence stealer
- Modifies WinLogon for persistence
  persistence
- UPX dump on OEP (original entry point)
- Drops file in Drivers directory
- Sets service image path in registry
  persistence
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Modifies WinLogon
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Browser Extensions

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarepersistencestealer

behavioral2

adwarepersistencestealer

© 2018-2025

Terms | Privacy