Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

05d1cf1d8a...5b.exe

windows7-x64

10

05d1cf1d8a...5b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05d1cf1d8a06c7db5b6a37a616ef6f54fb13e863e9785cb431ae060efb04185b

  • Size

    1.5MB

  • Sample

    240901-eap3ys1dje

  • MD5

    ce5aed08ef0b8c758f49605d860dfbc0

  • SHA1

    6db3aa68327bfea13dd178b4e5e4694b9e726462

  • SHA256

    05d1cf1d8a06c7db5b6a37a616ef6f54fb13e863e9785cb431ae060efb04185b

  • SHA512

    6b8af571bfa24b3ef2f3faba08dc7e4a105df7fd86b9838da50241402385108096b3788e783fb7265529120505d11c76da91849bd9c0d36f3088a2c9fc8e2db0

  • SSDEEP

    24576:P4nXubIQGyxbPV0db26fLywtAvfAc+bv8++UHavwRerOC2V:Pqe3f6yqAH+7A4avwR51

Score
10/10
discoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      05d1cf1d8a06c7db5b6a37a616ef6f54fb13e863e9785cb431ae060efb04185b

    • Size

      1.5MB

    • MD5

      ce5aed08ef0b8c758f49605d860dfbc0

    • SHA1

      6db3aa68327bfea13dd178b4e5e4694b9e726462

    • SHA256

      05d1cf1d8a06c7db5b6a37a616ef6f54fb13e863e9785cb431ae060efb04185b

    • SHA512

      6b8af571bfa24b3ef2f3faba08dc7e4a105df7fd86b9838da50241402385108096b3788e783fb7265529120505d11c76da91849bd9c0d36f3088a2c9fc8e2db0

    • SSDEEP

      24576:P4nXubIQGyxbPV0db26fLywtAvfAc+bv8++UHavwRerOC2V:Pqe3f6yqAH+7A4avwR51

    Score
    10/10
    discoveryevasionpersistenceprivilege_escalationtrojan

    • UAC bypass

      evasiontrojan

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

1
T1562.001

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks