Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

253935677b...f5.exe

windows7-x64

10

253935677b...f5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    253935677b9f338c6a8408e1d356b204036b8af3a57b3a8942079137b9660bf5

  • Size

    4.2MB

  • Sample

    240310-yp5xhaah98

  • MD5

    873c6264052761245df6b117738ac825

  • SHA1

    855b7550370d5e7ae1e530d1b99cd1103fc0b626

  • SHA256

    253935677b9f338c6a8408e1d356b204036b8af3a57b3a8942079137b9660bf5

  • SHA512

    9a8de1df29aa30f86f1b7bd6026b861749828c36c44023ee2ae8d3e5d53ca4561a7d45df34e39caf2deb729698f90bd80f29abc814f33aedb13a4fae7491f698

  • SSDEEP

    6144:8cFvrd1rWkNYiclkBw1x42dy8r1YA+ycK23+86JQPDHDdx/QtqV:d1dCicWy1xFc8r1N+ZKlPJQPDHvd

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      253935677b9f338c6a8408e1d356b204036b8af3a57b3a8942079137b9660bf5

    • Size

      4.2MB

    • MD5

      873c6264052761245df6b117738ac825

    • SHA1

      855b7550370d5e7ae1e530d1b99cd1103fc0b626

    • SHA256

      253935677b9f338c6a8408e1d356b204036b8af3a57b3a8942079137b9660bf5

    • SHA512

      9a8de1df29aa30f86f1b7bd6026b861749828c36c44023ee2ae8d3e5d53ca4561a7d45df34e39caf2deb729698f90bd80f29abc814f33aedb13a4fae7491f698

    • SSDEEP

      6144:8cFvrd1rWkNYiclkBw1x42dy8r1YA+ycK23+86JQPDHDdx/QtqV:d1dCicWy1xFc8r1N+ZKlPJQPDHvd

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks