Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

29d280740c...0N.exe

windows7-x64

10

29d280740c...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    29d280740c7417431fd927ce30dbcdf0N.exe

  • Size

    2.0MB

  • Sample

    240905-cavmbs1ckr

  • MD5

    29d280740c7417431fd927ce30dbcdf0

  • SHA1

    4ff07e2440f2640aab42cd6c8e98245c24c99a3f

  • SHA256

    b9d090a1f6ce6a1763fbabbab76174b64aaa6805f4d13117def8e9e229a7e05f

  • SHA512

    826d2a85fbe02717840552be6e69252b5e366aa2e4ea122d0eec55e686ac919ffc876a1626bbdaffea7f5291da1a8febcb3f33e72cd9400134d55540a3573402

  • SSDEEP

    49152:MsThC6TYNwUXz+JR2wjx8+X5gZ+th1aaucQPfM7cSCGDt7WWcrRhajx3l7bQonWN:MsThC6TYNwUXz+JR2wjx8+JgZ+th1aaO

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Targets

    • Target

      29d280740c7417431fd927ce30dbcdf0N.exe

    • Size

      2.0MB

    • MD5

      29d280740c7417431fd927ce30dbcdf0

    • SHA1

      4ff07e2440f2640aab42cd6c8e98245c24c99a3f

    • SHA256

      b9d090a1f6ce6a1763fbabbab76174b64aaa6805f4d13117def8e9e229a7e05f

    • SHA512

      826d2a85fbe02717840552be6e69252b5e366aa2e4ea122d0eec55e686ac919ffc876a1626bbdaffea7f5291da1a8febcb3f33e72cd9400134d55540a3573402

    • SSDEEP

      49152:MsThC6TYNwUXz+JR2wjx8+X5gZ+th1aaucQPfM7cSCGDt7WWcrRhajx3l7bQonWN:MsThC6TYNwUXz+JR2wjx8+JgZ+th1aaO

    Score
    10/10
    discoveryevasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks