Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

Asus Editi...ed.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Asus Edition Perm_protected.exe

  • Size

    4.0MB

  • Sample

    250307-wheevsvms6

  • MD5

    559d539d2b304649a7ab508a0eca82fa

  • SHA1

    4422d8003d06a1ada3d0916d1fca4a50fac6a16a

  • SHA256

    2570cab05047fa0f7e5390c5fa33be57e59555dd57d9af8120cdc983aa7da5e9

  • SHA512

    83898bbc6f09b57e138a7b052b4a82bf0ecfe6ed4866bf4c59dea604ceb0f48eed8996761c8250696e92254b5d473317381f00631257408a4cd351718bb692be

  • SSDEEP

    98304:orwM43x0TE3w3klvFoVIZ9cZLVW7hqZw+/AO57wQoUY:swWI30kvoVOcZRCqX3RwQlY

Score
10/10
cerberdefense_evasionransomwarethemidatrojan

Malware Config

Targets

    • Target

      Asus Edition Perm_protected.exe

    • Size

      4.0MB

    • MD5

      559d539d2b304649a7ab508a0eca82fa

    • SHA1

      4422d8003d06a1ada3d0916d1fca4a50fac6a16a

    • SHA256

      2570cab05047fa0f7e5390c5fa33be57e59555dd57d9af8120cdc983aa7da5e9

    • SHA512

      83898bbc6f09b57e138a7b052b4a82bf0ecfe6ed4866bf4c59dea604ceb0f48eed8996761c8250696e92254b5d473317381f00631257408a4cd351718bb692be

    • SSDEEP

      98304:orwM43x0TE3w3klvFoVIZ9cZLVW7hqZw+/AO57wQoUY:swWI30kvoVOcZRCqX3RwQlY

    Score
    10/10
    cerberdefense_evasionransomwarethemidatrojan

    • Cerber

      Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

      ransomwarecerber

    • Cerber family

      cerber

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks