71bab121a732623076aef7bb44a8486bbb40338d95ab2486f3030642d1e1c0c7 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

71bab121a7...c7.exe

windows7-x64

71bab121a7...c7.exe

windows10-2004-x64

Sharing

General

Target

71bab121a732623076aef7bb44a8486bbb40338d95ab2486f3030642d1e1c0c7
Size

51KB
Sample

240517-aasfvsff4v
MD5

5b708795ed40c6821f5f0d527a647ab6
SHA1

aa68afdf3beecf9db8b2ffbdb1c3e705f183e5df
SHA256

71bab121a732623076aef7bb44a8486bbb40338d95ab2486f3030642d1e1c0c7
SHA512

1a0a70e3b7e2d7fa0fb49a9a2e61f69967c42c6b7011d6d7b348ac1b97d3ae94fb46137690a28caf9b5232b315a2d11bd9ae2e2aec6d362d9fc24c18165f90b3
SSDEEP

768:nNAGAkIo/juokwoL7627d9rIiClJAxiFkJT22euOiya6lHOYxY0x0KS37:nNJb/HkwoLe29UjQ4wqQOLIMVnS37

Score

10^/10

evasion persistence upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

71bab121a732623076aef7bb44a8486bbb40338d95ab2486f3030642d1e1c0c7.exe

Resource

win7-20240221-en

evasion persistence upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

71bab121a732623076aef7bb44a8486bbb40338d95ab2486f3030642d1e1c0c7.exe

Resource

win10v2004-20240508-en

evasion persistence upx

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  71bab121a732623076aef7bb44a8486bbb40338d95ab2486f3030642d1e1c0c7
- Size
  
  51KB
- MD5
  
  5b708795ed40c6821f5f0d527a647ab6
- SHA1
  
  aa68afdf3beecf9db8b2ffbdb1c3e705f183e5df
- SHA256
  
  71bab121a732623076aef7bb44a8486bbb40338d95ab2486f3030642d1e1c0c7
- SHA512
  
  1a0a70e3b7e2d7fa0fb49a9a2e61f69967c42c6b7011d6d7b348ac1b97d3ae94fb46137690a28caf9b5232b315a2d11bd9ae2e2aec6d362d9fc24c18165f90b3
- SSDEEP
  
  768:nNAGAkIo/juokwoL7627d9rIiClJAxiFkJT22euOiya6lHOYxY0x0KS37:nNJb/HkwoLe29UjQ4wqQOLIMVnS37
Score

10^/10

evasion persistence upx
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UPX dump on OEP (original entry point)
- Drops file in Drivers directory
- Modifies Installed Components in the registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx

© 2018-2025

Terms | Privacy