8def991589279e0d4169042e93b79ddce953443012fbd1c572d03efb2da56d75 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

2ef8d4c32b...0N.exe

windows7-x64

2ef8d4c32b...0N.exe

windows10-2004-x64

Sharing

General

Target

2ef8d4c32bf741fe4e44576b2e9a5020N.exe
Size

23KB
Sample

240714-16lajaxdjd
MD5

2ef8d4c32bf741fe4e44576b2e9a5020
SHA1

6dc03a40a9251ccc48b9c55f5a7af9097eb5d18a
SHA256

8def991589279e0d4169042e93b79ddce953443012fbd1c572d03efb2da56d75
SHA512

d04530a1e30b0f1b40a4717d7770749f0237bee2ea7e423b2a9c327f0880570b3040038a05934c493ea0818f4cf7cbe077fa79c3a8a3728cbf0a477c9f51f796
SSDEEP

384:jIz4ClC0Y2i/WqBfroAmbpXhA7qNHh9Ro7Eh6SjUbmc0FGc+RPV8A/L51qsLVn4:jIUGC0YPBfro7AuNHlogs5bmjMd8g5wp

Score

10^/10

evasion persistence trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2ef8d4c32bf741fe4e44576b2e9a5020N.exe

Resource

win7-20240708-en

evasion persistence trojan upx

windows7-x64

14 signatures

120 seconds

Behavioral task

behavioral2

Sample

2ef8d4c32bf741fe4e44576b2e9a5020N.exe

Resource

win10v2004-20240709-en

evasion persistence trojan upx

windows10-2004-x64

13 signatures

120 seconds

Malware Config

Targets

- Target
  
  2ef8d4c32bf741fe4e44576b2e9a5020N.exe
- Size
  
  23KB
- MD5
  
  2ef8d4c32bf741fe4e44576b2e9a5020
- SHA1
  
  6dc03a40a9251ccc48b9c55f5a7af9097eb5d18a
- SHA256
  
  8def991589279e0d4169042e93b79ddce953443012fbd1c572d03efb2da56d75
- SHA512
  
  d04530a1e30b0f1b40a4717d7770749f0237bee2ea7e423b2a9c327f0880570b3040038a05934c493ea0818f4cf7cbe077fa79c3a8a3728cbf0a477c9f51f796
- SSDEEP
  
  384:jIz4ClC0Y2i/WqBfroAmbpXhA7qNHh9Ro7Eh6SjUbmc0FGc+RPV8A/L51qsLVn4:jIUGC0YPBfro7AuNHlogs5bmjMd8g5wp
Score

10^/10

evasion persistence trojan upx
- Windows security bypass
  evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Winlogon Helper DLL

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Winlogon Helper DLL

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojanupx

behavioral2

evasionpersistencetrojanupx

© 2018-2025

Terms | Privacy