Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

source_prepared.exe

windows7-x64

7

source_prepared.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    86.9MB

  • Sample

    250210-p5xrdssrhx

  • MD5

    7101ab3efaf3baf5c615b9d6d111fdf6

  • SHA1

    ebef4c414ef1b3811e674a3cab69ff99fa984839

  • SHA256

    e92cd8e53a7a0f1240cf674c1834be4085ffac351d568f287c5cedb6b5cbd036

  • SHA512

    81e65189f8f0b76bd03f53ded4c2c5ad99079724282dc110e28ae4975c8c9a7e9456527f6ed113dfd7fb105e649891cbda29de66039852502c1c68df12222f35

  • SSDEEP

    1572864:t2GKl+WXr8sm/OkiqOv8im2A+79E7olitnnBiYgj+h58sMwA3e3VilcJ5Vrh:tnK4Dsm/OknOv8i3J7pwpT503e3VhV

Score
10/10
pysilondefense_evasiondiscoveryexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      86.9MB

    • MD5

      7101ab3efaf3baf5c615b9d6d111fdf6

    • SHA1

      ebef4c414ef1b3811e674a3cab69ff99fa984839

    • SHA256

      e92cd8e53a7a0f1240cf674c1834be4085ffac351d568f287c5cedb6b5cbd036

    • SHA512

      81e65189f8f0b76bd03f53ded4c2c5ad99079724282dc110e28ae4975c8c9a7e9456527f6ed113dfd7fb105e649891cbda29de66039852502c1c68df12222f35

    • SSDEEP

      1572864:t2GKl+WXr8sm/OkiqOv8im2A+79E7olitnnBiYgj+h58sMwA3e3VilcJ5Vrh:tnK4Dsm/OknOv8i3J7pwpT503e3VhV

    Score
    9/10
    upxdefense_evasiondiscoveryexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

1
T1112

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

File and Directory Discovery

1
T1083

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.