Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

7

ConsoleAct_x64.exe

windows7-x64

8

ConsoleAct_x64.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ConsoleAct_x64.exe

  • Size

    1.0MB

  • Sample

    240709-v6lcmswbjp

  • MD5

    8101ffc7c364c9d4d6810c9cbe5b3e43

  • SHA1

    fa266f7cc07d7b51fb1d5a86c73cecf204f28912

  • SHA256

    5665306da70d8314c1075753e62ccc4163722bc1dd01d6e440f8268e624764bf

  • SHA512

    9731b223ef1f02a7bb01afe13c985038517838166e1b90fc88aafa23aaf3e3fdb5a64229a0c5a8960608047f93b4afca0a6c10ad64f635104f01929e996520c7

  • SSDEEP

    24576:WV2HeytcxKV0XOnZe8i5dCppc50CxO7EyyXAAsWvZmSGqb4LQRyg:WVceytcb8i5WchOCQrWvZzGVQUg

Score
8/10
evasionexecutionpersistenceprivilege_escalationupx

Malware Config

Targets

    • Target

      ConsoleAct_x64.exe

    • Size

      1.0MB

    • MD5

      8101ffc7c364c9d4d6810c9cbe5b3e43

    • SHA1

      fa266f7cc07d7b51fb1d5a86c73cecf204f28912

    • SHA256

      5665306da70d8314c1075753e62ccc4163722bc1dd01d6e440f8268e624764bf

    • SHA512

      9731b223ef1f02a7bb01afe13c985038517838166e1b90fc88aafa23aaf3e3fdb5a64229a0c5a8960608047f93b4afca0a6c10ad64f635104f01929e996520c7

    • SSDEEP

      24576:WV2HeytcxKV0XOnZe8i5dCppc50CxO7EyyXAAsWvZmSGqb4LQRyg:WVceytcb8i5WchOCQrWvZzGVQUg

    Score
    8/10
    evasionexecutionpersistenceprivilege_escalationupx

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Modifies Windows Firewall

      evasion

    • Stops running service(s)

      evasionexecution

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

2
T1546

Image File Execution Options Injection

1
T1546.012

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

2
T1546

Image File Execution Options Injection

1
T1546.012

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Tasks