Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

source_prepared.exe

windows11-21h2-x64

9

Resubmissions

17/03/2025, 13:01

250317-p9ca9azza1 10

17/03/2025, 12:59

250317-p7317atms9 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    source_prepared.exe

  • Size

    88.5MB

  • Sample

    250317-p7317atms9

  • MD5

    4f0981abab66614230d83d599cd9ce9f

  • SHA1

    b3b306ec48c0c87a53feac0486fd92576a50919b

  • SHA256

    83f5b9d3bf343a23578a1c560847075450abac0bad4967ba44bc32544bea240c

  • SHA512

    6ef78894affb0fabbb33767d59fae2e57b56cf9a63abba5744eb2d2647fa88860028b96154701fbbc9efa7975505a9cbc4195ca7dec8d9b4f63dec77be5c68ab

  • SSDEEP

    1572864:gtIupudNK/lXAbWfGPgOkiqOv8im2A3+TUE7GliXiYgj+h58sMw5ICPEBcJFJZ:vYoWRo1YOknOv8i36+T4wp5FvPzJ

Score
10/10
pysilondefense_evasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      source_prepared.exe

    • Size

      88.5MB

    • MD5

      4f0981abab66614230d83d599cd9ce9f

    • SHA1

      b3b306ec48c0c87a53feac0486fd92576a50919b

    • SHA256

      83f5b9d3bf343a23578a1c560847075450abac0bad4967ba44bc32544bea240c

    • SHA512

      6ef78894affb0fabbb33767d59fae2e57b56cf9a63abba5744eb2d2647fa88860028b96154701fbbc9efa7975505a9cbc4195ca7dec8d9b4f63dec77be5c68ab

    • SSDEEP

      1572864:gtIupudNK/lXAbWfGPgOkiqOv8im2A3+TUE7GliXiYgj+h58sMw5ICPEBcJFJZ:vYoWRo1YOknOv8i36+T4wp5FvPzJ

    Score
    9/10
    defense_evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks