0ca47f3cc10adb0e2b58ac4dbc53bf3eafd91a57fde941d20b0255b80cb6498d | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

0ca47f3cc1...8d.exe

windows7-x64

0ca47f3cc1...8d.exe

windows10-2004-x64

Sharing

General

Target

0ca47f3cc10adb0e2b58ac4dbc53bf3eafd91a57fde941d20b0255b80cb6498d
Size

91KB
Sample

240619-w97wgswdqa
MD5

1ad06c84941d002251f4909077d551b2
SHA1

bd6619b20b250923df604387847a47192550d123
SHA256

0ca47f3cc10adb0e2b58ac4dbc53bf3eafd91a57fde941d20b0255b80cb6498d
SHA512

76df341dd0a83c36c3453b33db54cc88f14ae7a58876c7a63caccfa14df2182ac65522cf8d9d8687cb69dbfa8911edeb7c4a7aac06c98e0f702e4c933ce3c33e
SSDEEP

1536:zAwEmBZ04faWmtN4nic+6GEAwEmBZ04faWmtN4nic+6Gf:zGms4Eton0EGms4Eton0f

Score

10^/10

evasion persistence

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

0ca47f3cc10adb0e2b58ac4dbc53bf3eafd91a57fde941d20b0255b80cb6498d.exe

Resource

win7-20240419-en

evasion persistence

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral2

Sample

0ca47f3cc10adb0e2b58ac4dbc53bf3eafd91a57fde941d20b0255b80cb6498d.exe

Resource

win10v2004-20240508-en

evasion persistence

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  0ca47f3cc10adb0e2b58ac4dbc53bf3eafd91a57fde941d20b0255b80cb6498d
- Size
  
  91KB
- MD5
  
  1ad06c84941d002251f4909077d551b2
- SHA1
  
  bd6619b20b250923df604387847a47192550d123
- SHA256
  
  0ca47f3cc10adb0e2b58ac4dbc53bf3eafd91a57fde941d20b0255b80cb6498d
- SHA512
  
  76df341dd0a83c36c3453b33db54cc88f14ae7a58876c7a63caccfa14df2182ac65522cf8d9d8687cb69dbfa8911edeb7c4a7aac06c98e0f702e4c933ce3c33e
- SSDEEP
  
  1536:zAwEmBZ04faWmtN4nic+6GEAwEmBZ04faWmtN4nic+6Gf:zGms4Eton0EGms4Eton0f
Score

10^/10

evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Detects executables built or packed with MPress PE compressor
- Disables RegEdit via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence

© 2018-2025

Terms | Privacy