4cf0238cdd275a66de9ee1ea32e02ce3fc4bb6d33cf9bdc1ba39c6c58789830e | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

7

4cf0238cdd...0e.exe

windows7-x64

4cf0238cdd...0e.exe

windows10-2004-x64

Sharing

General

Target

4cf0238cdd275a66de9ee1ea32e02ce3fc4bb6d33cf9bdc1ba39c6c58789830e
Size

20KB
Sample

240613-2gqz6axamm
MD5

02fc12942ca3aade3adb4b3c30524d4e
SHA1

486cc3e5f7f48cd55f8e19e554802cfc571e2c1c
SHA256

4cf0238cdd275a66de9ee1ea32e02ce3fc4bb6d33cf9bdc1ba39c6c58789830e
SHA512

f720ef88792e967a57e1db265d109033aea71968d394ffa0fab5fad0029d2bd9074282c7036f34401c27d4b40748364e825652745f3ea443035bc67b46ffc753
SSDEEP

384:UBWoC5GDr6wc/w3HgM6vDUTAXBGCVf4WVlFvX89skaG:rRkiLw3HsDSARGG/s9skx

Score

10^/10

evasion persistence trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

4cf0238cdd275a66de9ee1ea32e02ce3fc4bb6d33cf9bdc1ba39c6c58789830e.exe

Resource

win7-20240508-en

evasion persistence trojan upx

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

4cf0238cdd275a66de9ee1ea32e02ce3fc4bb6d33cf9bdc1ba39c6c58789830e.exe

Resource

win10v2004-20240508-en

evasion persistence trojan upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  4cf0238cdd275a66de9ee1ea32e02ce3fc4bb6d33cf9bdc1ba39c6c58789830e
- Size
  
  20KB
- MD5
  
  02fc12942ca3aade3adb4b3c30524d4e
- SHA1
  
  486cc3e5f7f48cd55f8e19e554802cfc571e2c1c
- SHA256
  
  4cf0238cdd275a66de9ee1ea32e02ce3fc4bb6d33cf9bdc1ba39c6c58789830e
- SHA512
  
  f720ef88792e967a57e1db265d109033aea71968d394ffa0fab5fad0029d2bd9074282c7036f34401c27d4b40748364e825652745f3ea443035bc67b46ffc753
- SSDEEP
  
  384:UBWoC5GDr6wc/w3HgM6vDUTAXBGCVf4WVlFvX89skaG:rRkiLw3HsDSARGG/s9skx
Score

10^/10

evasion persistence trojan upx
- Windows security bypass
  evasion trojan
- Drops file in Drivers directory
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojanupx

behavioral2

evasionpersistencetrojanupx

© 2018-2025

Terms | Privacy