5bf5c19ccd63a43377ac744360679fe8d9fb10372230a2e21644a4240a838dc8 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

5bf5c19ccd...c8.exe

windows7-x64

5bf5c19ccd...c8.exe

windows10-2004-x64

Sharing

General

Target

5bf5c19ccd63a43377ac744360679fe8d9fb10372230a2e21644a4240a838dc8
Size

51KB
Sample

240509-1vh12agf9x
MD5

73db7a683d1cc34fe08a08c15bc77641
SHA1

b479cf2916c5754de663685ad57d362a635166c9
SHA256

5bf5c19ccd63a43377ac744360679fe8d9fb10372230a2e21644a4240a838dc8
SHA512

810d5dfc16ed518264a909216ca89ebcf41e388e377ff55442d34cb74a436d9769c29b113798f1c63f04cb33931aa758e1fabfa5777ea67dacf14cd703b15040
SSDEEP

768:nNAGAkIo/juokwoL7627d9rIiClJAxiFkJT22euOiya6lHOYxY0x0KS3ZRRRRRRf:nNJb/HkwoLe29UjQ4wqQOLIMVnS3YG

Score

10^/10

evasion persistence upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

5bf5c19ccd63a43377ac744360679fe8d9fb10372230a2e21644a4240a838dc8.exe

Resource

win7-20240508-en

evasion persistence upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

5bf5c19ccd63a43377ac744360679fe8d9fb10372230a2e21644a4240a838dc8.exe

Resource

win10v2004-20240508-en

evasion persistence upx

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  5bf5c19ccd63a43377ac744360679fe8d9fb10372230a2e21644a4240a838dc8
- Size
  
  51KB
- MD5
  
  73db7a683d1cc34fe08a08c15bc77641
- SHA1
  
  b479cf2916c5754de663685ad57d362a635166c9
- SHA256
  
  5bf5c19ccd63a43377ac744360679fe8d9fb10372230a2e21644a4240a838dc8
- SHA512
  
  810d5dfc16ed518264a909216ca89ebcf41e388e377ff55442d34cb74a436d9769c29b113798f1c63f04cb33931aa758e1fabfa5777ea67dacf14cd703b15040
- SSDEEP
  
  768:nNAGAkIo/juokwoL7627d9rIiClJAxiFkJT22euOiya6lHOYxY0x0KS3ZRRRRRRf:nNJb/HkwoLe29UjQ4wqQOLIMVnS3YG
Score

10^/10

evasion persistence upx
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UPX dump on OEP (original entry point)
- Drops file in Drivers directory
- Modifies Installed Components in the registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx

© 2018-2025

Terms | Privacy