Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

EGS-EP2409...R).exe

windows7-x64

3

EGS-EP2409...R).exe

windows10-2004-x64

3

Middle/mes...ic.ps1

windows7-x64

8

Middle/mes...ic.ps1

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    EGS-EP2409 备件申请单 (HATCH COVER).exe

  • Size

    442KB

  • Sample

    240709-ltcqasxejm

  • MD5

    5c2bc6f8c3d4ea7bab62d2c1abe58913

  • SHA1

    3f5a0fcdf9af02028b621d24be500427aad24ce6

  • SHA256

    0f3a051a337f67ddc03830bcd2f4e1d2ef463d9fbfb5684f842db5c828fa1c70

  • SHA512

    231b6672972568ddada04952edfd3a5740f4e4853beeac262290769136c26618fc701c575cb4073d08ca2e2297ec356c219fe37413f6905c06cf58107f55695a

  • SSDEEP

    12288:ktFFQIhZrAlwAeCTQY5dbJl43wFuYbI+NwMc:ktPQ2Ul5eeddVLA

Score
8/10
executionpersistence

Malware Config

Targets

    • Target

      EGS-EP2409 备件申请单 (HATCH COVER).exe

    • Size

      442KB

    • MD5

      5c2bc6f8c3d4ea7bab62d2c1abe58913

    • SHA1

      3f5a0fcdf9af02028b621d24be500427aad24ce6

    • SHA256

      0f3a051a337f67ddc03830bcd2f4e1d2ef463d9fbfb5684f842db5c828fa1c70

    • SHA512

      231b6672972568ddada04952edfd3a5740f4e4853beeac262290769136c26618fc701c575cb4073d08ca2e2297ec356c219fe37413f6905c06cf58107f55695a

    • SSDEEP

      12288:ktFFQIhZrAlwAeCTQY5dbJl43wFuYbI+NwMc:ktPQ2Ul5eeddVLA

    Score
    3/10
    behavioral1behavioral2

    • Target

      Middle/messingens/Sortkjolernes67/Permanganic.Wit175

    • Size

      59KB

    • MD5

      11e1974573075a613a43f0b1678e8ac8

    • SHA1

      4ac842d91c14c5f2be7541223568336d7efab375

    • SHA256

      847c0aec5765d5fbe9c72aee962ed9939e079877eb557b77532e20ef0236c3a9

    • SHA512

      005bbec6429afc827d5ecd55dc85bbde2b8a65d3bd047ed046375ae6438a7cf87adc95420db7a4f7fde3d1e693c5797ef0ee1e7b7ac5500ab7649e8fb19fc6bc

    • SSDEEP

      1536:q85lZ8tkEDlXpUJaYx23/qLZfHJ1qR8S0o6iUH:9pokYpsa6Blx1vU8H

    Score
    8/10
    executionpersistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks