a026042dc2e48257fbf609822d8d9e396ef272a351e9f9ae26d2a825b9a80a05 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

a026042dc2...05.exe

windows7-x64

a026042dc2...05.exe

windows10-2004-x64

Sharing

General

Target

a026042dc2e48257fbf609822d8d9e396ef272a351e9f9ae26d2a825b9a80a05
Size

91KB
Sample

240526-bmv8yshe41
MD5

5b55d07ee1a06e0e149f7a12031ea5e1
SHA1

dca66ca8c269ea9ca355d6e0b3f3d1925db63faa
SHA256

a026042dc2e48257fbf609822d8d9e396ef272a351e9f9ae26d2a825b9a80a05
SHA512

83491e7ed10c4125e9d9ff34abef77726d23e6e6166309b16224528c6f859dff936fa27d538859a99f6009bbc634855f1c1a570893c1d974f5d7341f3e6af60e
SSDEEP

1536:XRsjdLaslqdBXvTUL0Hnouy8VjERsjdLaslqdBXvTUL0Hnouy8VjYf:XOJKqsout9EOJKqsout9Yf

Score

10^/10

evasion persistence upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

a026042dc2e48257fbf609822d8d9e396ef272a351e9f9ae26d2a825b9a80a05.exe

Resource

win7-20240221-en

evasion persistence upx

windows7-x64

20 signatures

150 seconds

Behavioral task

behavioral2

Sample

a026042dc2e48257fbf609822d8d9e396ef272a351e9f9ae26d2a825b9a80a05.exe

Resource

win10v2004-20240508-en

evasion persistence upx

windows10-2004-x64

18 signatures

150 seconds

Malware Config

Targets

- Target
  
  a026042dc2e48257fbf609822d8d9e396ef272a351e9f9ae26d2a825b9a80a05
- Size
  
  91KB
- MD5
  
  5b55d07ee1a06e0e149f7a12031ea5e1
- SHA1
  
  dca66ca8c269ea9ca355d6e0b3f3d1925db63faa
- SHA256
  
  a026042dc2e48257fbf609822d8d9e396ef272a351e9f9ae26d2a825b9a80a05
- SHA512
  
  83491e7ed10c4125e9d9ff34abef77726d23e6e6166309b16224528c6f859dff936fa27d538859a99f6009bbc634855f1c1a570893c1d974f5d7341f3e6af60e
- SSDEEP
  
  1536:XRsjdLaslqdBXvTUL0Hnouy8VjERsjdLaslqdBXvTUL0Hnouy8VjYf:XOJKqsout9EOJKqsout9Yf
Score

10^/10

evasion persistence upx
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UPX dump on OEP (original entry point)
- Disables RegEdit via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceupx

behavioral2

evasionpersistenceupx

© 2018-2025

Terms | Privacy