Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

a391f0b4b1...AS.exe

windows7-x64

10

a391f0b4b1...AS.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a391f0b4b19ea7189df5320bb2c44f30_NEAS

  • Size

    2.6MB

  • Sample

    240507-qs7w9scc66

  • MD5

    a391f0b4b19ea7189df5320bb2c44f30

  • SHA1

    078c1836a49bed9672f999aa31a4409730e8872e

  • SHA256

    684ff6aeffa333f9f2f55ca6bede9d52c72a8536a725ed78045d7eff7c1413a2

  • SHA512

    af7dd79a90bdf989728b8ef0cbccec9757d96a51258709d0dc9b1615d7f1006b9a85166069e629b393db1e4948d08ec9d7d41d8bcb37e0bd17110ef6ebaf3d50

  • SSDEEP

    49152:XXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVL:XXzhW148Pd+Tf1mpcOldJQ3/VL

Score
10/10
evasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      a391f0b4b19ea7189df5320bb2c44f30_NEAS

    • Size

      2.6MB

    • MD5

      a391f0b4b19ea7189df5320bb2c44f30

    • SHA1

      078c1836a49bed9672f999aa31a4409730e8872e

    • SHA256

      684ff6aeffa333f9f2f55ca6bede9d52c72a8536a725ed78045d7eff7c1413a2

    • SHA512

      af7dd79a90bdf989728b8ef0cbccec9757d96a51258709d0dc9b1615d7f1006b9a85166069e629b393db1e4948d08ec9d7d41d8bcb37e0bd17110ef6ebaf3d50

    • SSDEEP

      49152:XXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVL:XXzhW148Pd+Tf1mpcOldJQ3/VL

    Score
    10/10
    evasionpersistencethemidatrojan

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks