34e8c0ae085fc555f0440edc3c514efa11148f176726e1afc806edf387752211 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

34e8c0ae08...11.exe

windows7-x64

34e8c0ae08...11.exe

windows10-2004-x64

Sharing

General

Target

34e8c0ae085fc555f0440edc3c514efa11148f176726e1afc806edf387752211
Size

91KB
Sample

240625-yt921ssfll
MD5

f0a63c666cb73fb5d97b2e945b1bfef6
SHA1

953008051f8a4b3a4766850a4351d655a045e5bd
SHA256

34e8c0ae085fc555f0440edc3c514efa11148f176726e1afc806edf387752211
SHA512

eadd974a9b5427b274ed0136b27c4b59f4624d09b6fac2698a189a2450f70d7df9a8fa168e61e3f6fe99329c06d069d54679ad30fa67307d4d536b683eaf37d0
SSDEEP

1536:zAwEmBZ04faWmtN4nic+6GAAwEmBZ04faWmtN4nic+6GU:zGms4Eton0AGms4Eton0U

Score

10^/10

evasion persistence

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

34e8c0ae085fc555f0440edc3c514efa11148f176726e1afc806edf387752211.exe

Resource

win7-20240419-en

evasion persistence

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral2

Sample

34e8c0ae085fc555f0440edc3c514efa11148f176726e1afc806edf387752211.exe

Resource

win10v2004-20240508-en

evasion persistence

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  34e8c0ae085fc555f0440edc3c514efa11148f176726e1afc806edf387752211
- Size
  
  91KB
- MD5
  
  f0a63c666cb73fb5d97b2e945b1bfef6
- SHA1
  
  953008051f8a4b3a4766850a4351d655a045e5bd
- SHA256
  
  34e8c0ae085fc555f0440edc3c514efa11148f176726e1afc806edf387752211
- SHA512
  
  eadd974a9b5427b274ed0136b27c4b59f4624d09b6fac2698a189a2450f70d7df9a8fa168e61e3f6fe99329c06d069d54679ad30fa67307d4d536b683eaf37d0
- SSDEEP
  
  1536:zAwEmBZ04faWmtN4nic+6GAAwEmBZ04faWmtN4nic+6GU:zGms4Eton0AGms4Eton0U
Score

10^/10

evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Detects executables built or packed with MPress PE compressor
- Disables RegEdit via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence

© 2018-2025

Terms | Privacy