Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
89s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
06/07/2024, 22:47
General
-
Target
external_obf.exe
-
Size
37.4MB
-
MD5
04a2203440a8e4ad58e9383272d2e4c4
-
SHA1
e8539a930e7feaf92e76a40a675afaee1f89fb2f
-
SHA256
d7f93dd3cc29ddbcc20355213ecc35226f0db4ba42c47c166310c6c937dd5180
-
SHA512
ac10acfbe4948b43f7b4ff6c311bca851958ab4ea21726c63125ac250853a704fbe6d4dda7ee2ae0176eeb3c4ce1c709e3784418463234d23ab767b473b6183b
-
SSDEEP
786432:Vn89EgmKjPMXH2BeGpip+3dYPkiNE4apoc0:VnoEgJzGWBeGpzdY5E4moc0
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 27 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\external_obf.exe"C:\Users\Admin\AppData\Local\Temp\external_obf.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52b1876d5054872575c86068798a15541
SHA12ff0eb9886c06c6719a1e845b51312b96eede5fa
SHA256996537298207b1567cd7e1754698ce2e494597e0c3f45af0289742563e836a7a
SHA512ad616e335c2ce34f70a77858fd9826962784b1c4afbda337c7e660e2c207b2e985e81afcf9e4f10029f92b7630150f1ea8de397211176bc79b26c7bbbfea8b8a
-
Filesize
1KB
MD59a766ae2a3da26cc4a30c7f47203c5d3
SHA19c8c1743aef4de2eebfa621468473e6752e2451b
SHA256ca1bd35c85a5c589fd50f0b6b67b09e78e71653ce18fdb8240b2f3455144cff0
SHA5122f1341cfbef71500d85486cb77e1bc5330847ab1adbedaf92869a9b0118908d8d2a138a538a010b2e80d21ac649c9243437f12b94798911c5f12802c6efd0a87
-
Filesize
1KB
MD58125213434a7fa4365ece498c0cbb0d0
SHA1ecd681da190b037f40c45f41cc1a45a27ef88a9f
SHA256da8e1584e52135fbe21409fbe151cc07ef809fd355165789005518141cabaef1
SHA5128920512167338b24d0f0204548023408bbefc8ed3b14770b86f0950c7a8d824712e71574bd79500f3fd9aace152dd52e813f5fec483825adb4aece2320a8fc4d
-
Filesize
1KB
MD5f328402572f364412ddf35c6f1f25720
SHA18b2c2be2777df5d7258f6907c2b01e5acad147f2
SHA2568a84cb96576d17707fd4e7f270b30c977fae166c93ebbc0d9c8c7407ab8c6a5b
SHA5129a6b2ce56bef8e2387871b881ea698b2bd18b347b48d16851d3194525d6533f464824a5b7c78eac4569b6e171d56c84eb63a78b41a318fc8dc07f065bb2b823e
-
Filesize
1KB
MD53a9edc92578a4ac48eda65e72ed94e9d
SHA19397a22b15c26d48f1a76ec31031f33feeb2492e
SHA256044d47c0deaca7be57c5e2533c519e598333977efbc50f8e693259372284fa6c
SHA51234cba89b2b470703725d3a44c37fd83cbe89406f6d6941aca69ca51f980ece8b1b71e44a70d8bfeadb929a67d158873b84a4192a6759665399f23cbbb170f49f
-
Filesize
1KB
MD5c8ff16b1aee78777dc2d0ba1884d04a8
SHA1e826bedb85ee79cef3db6876a42773e54bead5d8
SHA2568310d0e8f270281bea4397f8c983d7ab9e31d0220b1b806e09a574dca5b351a9
SHA512efb13ea84596f2e9eb259f363834787a6e98394f2d66f1bb73209d7b17448c50bbb9100d2e61013b7454abac230af8e478dfc7fab30ae0dad2680ce3eef964a9
-
Filesize
1KB
MD58e9785c89427e09b4b0fa3d23bd91de9
SHA122ba68ea5683f423ecd6dcb35b5cad56dc5943b4
SHA2568937f93aadcc2e66f2e4ff48f3bc194c4f56a2171105423047cbdea00a729312
SHA5128d65d28aaeb1133b2ea430b328722381c9d7edbc9f735bf8ac37852b72599c526aed678a31137b9793e4b8a6d5549e9896adbae2f246f8a081df0a09d63f121c
-
Filesize
1KB
MD51403ec3c9e96b4b8f39d54a31ec93458
SHA16f54faf70d9b7dc7dacd94f61daf5e015e7448dc
SHA25653bae57b6164c44d139e906d00acd85a6fd8e6b6439d3769d2b5e42b300d641d
SHA512c7cefbf5f8655c32ba89100437fe858c0a48d3b2ef97230f2394eb3a7918597581e4e2e7d22802ee719330c3563776ddd65b232e0e003f16ea94b2cab49edc4a
-
Filesize
1KB
MD5a1e7c567a2b49392fc38d419ddaf91aa
SHA1dc4b1b8de3b9571d17b9956eb75bf4055c99d9f8
SHA2566dcc863334c227a8c9c27e1efe6db78ace872f1a8ef97db0d6303d4ac6c327de
SHA512b726573252e074e75c8067f00ffb7127e5c9dd2d95acd355f9ee2b2b8936e22de52f6a534a6adb5f3ef9ee1a9983dfd7011c2b5e37f6d2052385ce898fd74535
-
Filesize
1KB
MD50ee2e86147afd2e9c7a6193742f3a4ae
SHA1033a1f73f624bf2a9d9f995903c62a03fe14dbb0
SHA25669c81189014fa3aae2194d35c05cc320802ec69016f4d99622100d2acffe5fd5
SHA512db81f2c0ef463ac1bde4a4767d0c1d1e856f675f0e2b516f865741c280829d87b556ed6c2f60eb4dd1a778de0002a944458514256e2f0903f5ae246a6e92204d
-
Filesize
1KB
MD50390233a45dfbc1e1615f8da655ef557
SHA1c74288dc384bd7054d398fb8aee62e91236dc97b
SHA256ba9db21520008db8518bee164d411b103603dace7c6d6e03be5f6c82f6cc54ae
SHA51288e85e48ba999a157b29e1c539e70ebfddc01d2cc59e0d3e5215cf8c5044acb0cd4d7d1b50215b14ed76be6ebd373ee91257c57ad89e2e59bbe10e7c1f3ee542
-
Filesize
1KB
MD56e9fddd6356abaa078f908173cbc2033
SHA14f3e84e081d584fa54660044d18819ec0d5699af
SHA25683b83654e0a759e77d59df12f6e998ad87b76a40839d0b27dba2361800609475
SHA512d1b25c06e2a80517836d13ed1f94926139423570df7c800773e994ed7c2cd30dd0c31c12208ccfaacaf4c08cc06507df68ad9b64f20471a9ce40e93c97cda193
-
Filesize
1KB
MD5073de173d28dcc84d3078365eebe868f
SHA171d29f7ad67d5376445583d4990617335568c7cb
SHA2566c3b3e438d52092093db739ab1b5eedb4e6f8daa768f07ef9c6c1aa2c030e2a9
SHA5126119d1f1ad2870635570029711b5e68b4403e4bad039d68ae5f8a8174b7f9764d70399c14854f9566c3b6e83debd75ed746920dc7b4cfafbc7313f6f169e0b40
-
Filesize
1KB
MD539f53480311c7d3430cccdd7d24aa549
SHA1a4d798ce4b3b75db9b3646e7e7c5c0825a0029a6
SHA256f32191a5356167b66cfcdbd22a0aadfa23295679924ad63c32f8ab62b855cb69
SHA51216444f57eca7855e307b28198c39ac3369bd0cc6369346966ab73b151c6673abf3e81718bb2c62aacfdd3156d30774cacd2baaade4754e0cb1b7be71773d9732
-
Filesize
1KB
MD5a20f3230804c258a5942553c64adc87c
SHA153945fe1d512cce73f257147eebd7ca53fcd5cc4
SHA256b9a6a6685e5da28c299cb2d32d3e2ce5c867325cf962c59d876ac27737192522
SHA51264f33fcb29faaa3f05b81610ac8de73cf3ee823b7f594073adfe17e95ac49477970ace73fa581708056ced7870868dd27fe470a1f1347eb8e6f4866907364977
-
Filesize
1KB
MD5456aba23c80ae46d4c37780fdd630e5c
SHA1a04033ae1b6c22971daa84d97b4adfc4234906e1
SHA256a9132fe7ba5d34cf482bf9a5beda16857335f81522725bb53434d283c14bcf69
SHA5122f63a1bd6d60f66e9b75c598aff4be75035e9b2932ade0fffb2befd78ced6450745bd254dd70f80a52ebeb8c1dd4786771ea44fbdff66036304b7fd427c952de
-
Filesize
1KB
MD58dedec68cd3c6727edcd9d868032fe03
SHA195858879fa676d0622fdbb04252705426a8e81e7
SHA256bf7cc7efee31bc39ecb6ae0bc161c3f79d82742b4e8788af98ebd5664a9e201d
SHA5120a5ab89eaed609ff5846cbcad24949fc54409258aa533464d1148980b35cd9c48664455d7544c2f893303b61476e2f313405c4017ce558cbea2a6d56d171c9b5
-
Filesize
1KB
MD54a60e57cb0e0870c705b767d5f062fd5
SHA1ea1cb568abc128e7253b1c4495d52cbe21b79beb
SHA2561577b5175189816d6b3853140af391a14d6fc7be0332964f47af4745c51db6e7
SHA512db7891d9320842b2595c3f0b1021fd035467da8f58a3cb48b31d9e588794113055a1883d8ce572a04a42ac76860f7e57da8d154a45d1f4879848bf76122f9997
-
Filesize
1KB
MD5dd366a1aa8ff08588a4e2bcb45d457ef
SHA1b95e345b10380b61937c90a2bc7a10384882628c
SHA256ea362d6ebb9d153a4809ab732faa7c57b6e768574b64a78ea059c613fcf9a462
SHA512423684f89c971146e270412007776803588e6439dc717941c4f98db1fc5cfabf857812973fa02fc552d9593b2ec9fafa15f1335185b88e96e0de5a74d30f4ca2
-
Filesize
1KB
MD5b24e1a4e95ef8cd7522899420063b1f3
SHA1ae1586aba28b089fa62edb4f607039e79137559e
SHA25665a87347e5c4f633f542ac66a3e3c1a220666523aa4aa13d4dd0842595b47711
SHA512b128b8161e9024dfe40ad22482957ece534dd97264a99965d6621b72d25b934bb49e7f78fa1b4c7077aa2d36efd2e05e3f6b57b1968857d857a087cf2c1e1ee6
-
Filesize
1KB
MD5ba9031abb5e4e62c27f35144a63396b4
SHA1c2d44ccd657495c0a82d40d1f3473e0cde3092a9
SHA2562498201d354b7b8c12bfb7fb7e610abdd9a7bbe08629c7191460430dfffe36ab
SHA51286bd41e55976fee081227b1a1aa192211e218ea62dcdec577b8acc80cd7de5bb057961b1cdcfad8e8c72b1a314b044ce34b285d6de2c6a48a11d3f463ed793c1
-
Filesize
1KB
MD514b543fa3f4a4ba3bf24d3d114400281
SHA110948e30aa38ce30e3d33469e75b939f55c95d4a
SHA256f759cb9e80161e56870d00987aa82b3389d893ddfd9f3f5e0cf17098647d69ea
SHA512b14aa57493136cddfc9534fb0b2c0b94b9e4de89016552c9aa26c43108537cf89034f0a2f83c247d156be7def41e9ddfa5dfe520232afff25f446b28da8adcb5
-
Filesize
5.8MB
-
Filesize
84KB
-
Filesize
156KB
-
Filesize
148KB
-
Filesize
124KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
156KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
148KB
-
Filesize
124KB
-
Filesize
148KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
39.6MB
-
Filesize
3.3MB
-
Filesize
39.6MB
-
Filesize
148KB
-
Filesize
48KB
-
Filesize
68KB
-
Filesize
3.3MB
-
Filesize
39.6MB
-
Filesize
156KB
-
Filesize
164KB
-
Filesize
84KB
-
Filesize
44KB
-
Filesize
39.6MB
-
Filesize
124KB
-
Filesize
39.6MB
-
Filesize
2.0MB
-
Filesize
148KB
-
Filesize
156KB
-
Filesize
39.6MB
-
Filesize
108KB
-
Filesize
3.3MB
-
Filesize
5.8MB
-
Filesize
2.0MB
-
Filesize
160KB
-
Filesize
2.0MB
-
Filesize
528KB
-
Filesize
696KB
-
Filesize
36KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
148KB
-
Filesize
39.6MB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
5.8MB
-
Filesize
28KB
-
Filesize
39.6MB
-
Filesize
2.0MB
-
Filesize
156KB
-
Filesize
136KB
-
Filesize
72KB
-
Filesize
224KB
-
Filesize
60KB
-
Filesize
80KB
-
Filesize
1.1MB
-
Filesize
5.8MB
-
Filesize
28KB
-
Filesize
36KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
36KB
-
Filesize
2.0MB
-
Filesize
48KB
-
Filesize
28KB
-
Filesize
148KB
-
Filesize
5.8MB
-
Filesize
108KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
148KB
-
Filesize
28KB
-
Filesize
3.3MB
-
Filesize
528KB
-
Filesize
696KB
-
Filesize
160KB
-
Filesize
36KB
-
Filesize
84KB
-
Filesize
68KB
-
Filesize
164KB
-
Filesize
84KB
-
Filesize
44KB
-
Filesize
124KB
-
Filesize
39.6MB
-
Filesize
136KB
-
Filesize
72KB
-
Filesize
224KB
-
Filesize
80KB
-
Filesize
1.1MB