Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

SecuriteIn...31.exe

windows7-x64

7

SecuriteIn...31.exe

windows10-2004-x64

9

Resubmissions

30/09/2024, 13:45

240930-q2te8sselg 10

16/05/2024, 16:11

240516-tm7k4acf5z 9

30/01/2024, 07:25

240130-h8ypjacfcj 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win64.Evo-gen.20285.22431.exe

  • Size

    10.7MB

  • Sample

    240516-tm7k4acf5z

  • MD5

    5bf290d7209f17eaee7d8548beaf29f6

  • SHA1

    fe6d790f22643fc139ac5a53cadc5554a855bdd4

  • SHA256

    105f50a076dffc8cc2abafd844a23d2b77b7b8fc3c3b3388202d5681bcacc910

  • SHA512

    ee79716c0bc2a0defc20f79a8dcdc67d0607083bc5c2bd9bb53e37fa91faebbb313600d721cde2f932d7498a316b4cf4ce3c89b83202009f52242e1b6725abc5

  • SSDEEP

    196608:iPLd8eOaPAEu9on3dDTeeNy+wfm/pf+xfdkReBnfXWKsnPtSDrIWOIWsDaqkH:YLdXeD9et5y+9/pWFGRUnfXBsnYDrIW6

Score
9/10
evasionpyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      SecuriteInfo.com.Win64.Evo-gen.20285.22431.exe

    • Size

      10.7MB

    • MD5

      5bf290d7209f17eaee7d8548beaf29f6

    • SHA1

      fe6d790f22643fc139ac5a53cadc5554a855bdd4

    • SHA256

      105f50a076dffc8cc2abafd844a23d2b77b7b8fc3c3b3388202d5681bcacc910

    • SHA512

      ee79716c0bc2a0defc20f79a8dcdc67d0607083bc5c2bd9bb53e37fa91faebbb313600d721cde2f932d7498a316b4cf4ce3c89b83202009f52242e1b6725abc5

    • SSDEEP

      196608:iPLd8eOaPAEu9on3dDTeeNy+wfm/pf+xfdkReBnfXWKsnPtSDrIWOIWsDaqkH:YLdXeD9et5y+9/pWFGRUnfXBsnYDrIW6

    Score
    9/10
    upxevasionpyinstallerspywarestealer

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Scheduled Task/Job

1
T1053

Persistence

Account Manipulation

1
T1098

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Privilege Escalation

Account Manipulation

1
T1098

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Process Discovery

1
T1057

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks