Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

johhnyporkie.exe

windows10-2004-x64

9

johhnyporkie.exe

windows10-ltsc_2021-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    johhnyporkie.exe

  • Size

    83.4MB

  • Sample

    250319-yaqh9svk13

  • MD5

    3dbef5d31661588428d0d829a0dec78e

  • SHA1

    69adca322cbe04c242c1d5630d517fa5f3aabfa4

  • SHA256

    cb5a5f52265e1e96dae57832a4d2f74bb181d279be3905c9e564ab80e06a970f

  • SHA512

    1b67223a36175085afcae6dd7bf97f2e982f8ee55e3c34fafcc453bd70d3399458bd9ec5ce390f9b6a4720d281fc60f1bdd25a4e7a587f3d4fd6352f3c8968e3

  • SSDEEP

    1572864:qtIupuDSKzlCWZPuOkiqOv8im2AsME7W5ylKtoKiY4MHHLeqPNLtDarZh0+uFU:RY2tES2OknOv8i3l45yMCMHVLterzuS

Score
10/10
pysilondefense_evasionexecutionpersistencepyinstallerupx

Malware Config

Targets

    • Target

      johhnyporkie.exe

    • Size

      83.4MB

    • MD5

      3dbef5d31661588428d0d829a0dec78e

    • SHA1

      69adca322cbe04c242c1d5630d517fa5f3aabfa4

    • SHA256

      cb5a5f52265e1e96dae57832a4d2f74bb181d279be3905c9e564ab80e06a970f

    • SHA512

      1b67223a36175085afcae6dd7bf97f2e982f8ee55e3c34fafcc453bd70d3399458bd9ec5ce390f9b6a4720d281fc60f1bdd25a4e7a587f3d4fd6352f3c8968e3

    • SSDEEP

      1572864:qtIupuDSKzlCWZPuOkiqOv8im2AsME7W5ylKtoKiY4MHHLeqPNLtDarZh0+uFU:RY2tES2OknOv8i3l45yMCMHVLterzuS

    Score
    9/10
    defense_evasionexecutionpersistenceupx

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks