Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
10/02/2025, 18:47
250210-xfdafs1phn 10General
-
Target
source_prepared.exe
-
Size
116.7MB
-
Sample
250210-xfdafs1phn
-
MD5
3a6f5832b8f5c692ee5ca00030196baf
-
SHA1
00e759c77dcd58370d4710aa62f564c15d69cdfc
-
SHA256
05b20a00303c619e731a2f13f25d677a23f976ec5ceb5fca4d7d79c18fab3500
-
SHA512
5fc3c0dedddeafad724684f781c99190cb257d8068ca5a656effb2d6b0f01cf0cc2b91f6d31c74ce78834153b28a885cade7929c392c2c4fb5fbc7143551b993
-
SSDEEP
3145728:4cN7eCRZeibJjz9wHE8/2qHO5iCpBnG0iWMstB2OxyKLuMV6:nN7JN1Zw/NHCiWhieB1
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20250207-en
Malware Config
Targets
-
-
Target
source_prepared.exe
-
Size
116.7MB
-
MD5
3a6f5832b8f5c692ee5ca00030196baf
-
SHA1
00e759c77dcd58370d4710aa62f564c15d69cdfc
-
SHA256
05b20a00303c619e731a2f13f25d677a23f976ec5ceb5fca4d7d79c18fab3500
-
SHA512
5fc3c0dedddeafad724684f781c99190cb257d8068ca5a656effb2d6b0f01cf0cc2b91f6d31c74ce78834153b28a885cade7929c392c2c4fb5fbc7143551b993
-
SSDEEP
3145728:4cN7eCRZeibJjz9wHE8/2qHO5iCpBnG0iWMstB2OxyKLuMV6:nN7JN1Zw/NHCiWhieB1
Score9/10-
Enumerates VirtualBox DLL files
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Virtualization/Sandbox Evasion
1