Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Utility.exe

windows10-1703-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Utility.exe

  • Size

    17.9MB

  • Sample

    241019-3xxcjswgna

  • MD5

    2a63534b1e6a3c5200c9c809e77f4c00

  • SHA1

    ba37d30a06a84fbff4e0d7869ea18369441edfed

  • SHA256

    7e3aab64a2b41bb8f9ac91cfa1fc1c0560358aa078d4de1852ae340183e18cf5

  • SHA512

    83dec0cf545f38912371013e6ddfbb5e09bf979517789547e590863117611af961a6405c30392fedef68bdcf6b45b64516f114f2430ea34c4b7dd1dd7b6a4ca8

  • SSDEEP

    393216:QqPnLFXlriQ8DOETgsvfG2gVwM+EXB3vExt/2vUiiq:RPLFXNiQhEhJvg2T+vJ

Score
10/10
empyreandiscoverypersistenceprivilege_escalationpyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      Utility.exe

    • Size

      17.9MB

    • MD5

      2a63534b1e6a3c5200c9c809e77f4c00

    • SHA1

      ba37d30a06a84fbff4e0d7869ea18369441edfed

    • SHA256

      7e3aab64a2b41bb8f9ac91cfa1fc1c0560358aa078d4de1852ae340183e18cf5

    • SHA512

      83dec0cf545f38912371013e6ddfbb5e09bf979517789547e590863117611af961a6405c30392fedef68bdcf6b45b64516f114f2430ea34c4b7dd1dd7b6a4ca8

    • SSDEEP

      393216:QqPnLFXlriQ8DOETgsvfG2gVwM+EXB3vExt/2vUiiq:RPLFXNiQhEhJvg2T+vJ

    Score
    7/10
    discoverypersistenceprivilege_escalationspywarestealerupx

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.