Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

V_main.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    V_main.exe

  • Size

    2.4MB

  • Sample

    241013-q41bkavajm

  • MD5

    eb20ae7073c363f97b2a42878b6bdbc4

  • SHA1

    ff1ad88be18ceb8bc3167d1b18d71b08138b270d

  • SHA256

    fb04167bc46b106878144485fb1d7f712d976e8717062dcf581e539036c10922

  • SHA512

    ee04988373fab6e26e8ef174bcbea2e3315ccfef5f3e2bfd6c65c8ae01bf10900f18d27b68eab15a63eb2e75c7c51f5df9426bbffb918d9301d08114aee2c423

  • SSDEEP

    49152:tWs9ii2J+AQceZktazy0nKxzxpW8gezQJ97BcnTIQ6aDbEPy9T:tWs9ii2J+ZZkozznK70teUBcTgZy9T

Score
10/10
discoveryevasionexecutionpersistence

Malware Config

Targets

    • Target

      V_main.exe

    • Size

      2.4MB

    • MD5

      eb20ae7073c363f97b2a42878b6bdbc4

    • SHA1

      ff1ad88be18ceb8bc3167d1b18d71b08138b270d

    • SHA256

      fb04167bc46b106878144485fb1d7f712d976e8717062dcf581e539036c10922

    • SHA512

      ee04988373fab6e26e8ef174bcbea2e3315ccfef5f3e2bfd6c65c8ae01bf10900f18d27b68eab15a63eb2e75c7c51f5df9426bbffb918d9301d08114aee2c423

    • SSDEEP

      49152:tWs9ii2J+AQceZktazy0nKxzxpW8gezQJ97BcnTIQ6aDbEPy9T:tWs9ii2J+ZZkozznK70teUBcTgZy9T

    Score
    10/10
    discoveryevasionexecutionpersistence

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Downloads MZ/PE file

    • Stops running service(s)

      evasionexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks