Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

source_prepared.exe

windows7-x64

7

source_prepared.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.zip

  • Size

    81.2MB

  • Sample

    240913-vc8abayalc

  • MD5

    10ecec64ec39e030b9c8dca17c589e16

  • SHA1

    620317eccba3ec20ea5ad134930c331aec6f9527

  • SHA256

    c43ba4674688b696d37be0123102595ead8335af525477bbbedfce9ee55a9475

  • SHA512

    82469457af35e58db68cde28852053359e8731a2a8272a240b909982b43cca2131776c0f502a7b790c05ab54f0d83e75e26566b167b3f6823225229cd21bae95

  • SSDEEP

    1572864:GXZh49YdDAn6ObGWZglOhpArAXb9tjG/bgBIRH8scNrYNjjapxe1/atD47YrRWU:G3oYJS6VWGLrAXb9Zx7MNuc1UyURWU

Score
10/10
pysilonevasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      81.6MB

    • MD5

      2d50c1e5ee7eb5a888c4f68f00abc07e

    • SHA1

      8980eb85bf3501d5890e518cb2cb6d1c83f884ad

    • SHA256

      eda5eddfb47860b05356bbf716833d6f436293784f8f2bdd5d369f5b6ea89f43

    • SHA512

      e3a17ed04c1c527ec881bcd1e0e885ea82b5779c8a740d6e233ba2d64897a4ca1bef7efb35545b7d123b388cf4d93bf5568cadf193d0494af8ba2d34fe20f95f

    • SSDEEP

      1572864:jvxZQglXedWFZSk8IpG7V+VPhqb+T9E7Ulg8iYgj+h58sMw5ID93AVqDNX:jvxZxRQyZSkB05awb+TJe25Fu93L

    Score
    9/10
    upxevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks