blankgrabber | 96608cf3b82070c59d15eb9695ff6aef8ee6e19d17a2d392ac29e6018026b2f4 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

96608cf3b8...f4.exe

windows7-x64

7

96608cf3b8...f4.exe

windows10-2004-x64

8

Sharing

General

Target

96608cf3b82070c59d15eb9695ff6aef8ee6e19d17a2d392ac29e6018026b2f4
Size

8.2MB
Sample

250327-nc3w9s1tds
MD5

4c678ae48d78541c32df40c3fb2ac55c
SHA1

9836074bfecd658a43864563f6512df5a3f85b11
SHA256

96608cf3b82070c59d15eb9695ff6aef8ee6e19d17a2d392ac29e6018026b2f4
SHA512

a1fd2363c889dd147834c61e3d1e03efad52f1934acb741f037660addfb49898f1d4d2cca8ae3a45b17e607d8029f2101b81ca3c573be8b3d0e009b7d17833cc
SSDEEP

196608:7WPxRgktJurErvI9pWjgyvoaYrE41JI1DIwoOdho:wgktJurEUWjdo/H1JS1oCho

Score

10^/10

blankgrabber discovery execution upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

96608cf3b82070c59d15eb9695ff6aef8ee6e19d17a2d392ac29e6018026b2f4.exe

Resource

win7-20240903-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

96608cf3b82070c59d15eb9695ff6aef8ee6e19d17a2d392ac29e6018026b2f4.exe

Resource

win10v2004-20250314-en

discovery execution upx

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  96608cf3b82070c59d15eb9695ff6aef8ee6e19d17a2d392ac29e6018026b2f4
- Size
  
  8.2MB
- MD5
  
  4c678ae48d78541c32df40c3fb2ac55c
- SHA1
  
  9836074bfecd658a43864563f6512df5a3f85b11
- SHA256
  
  96608cf3b82070c59d15eb9695ff6aef8ee6e19d17a2d392ac29e6018026b2f4
- SHA512
  
  a1fd2363c889dd147834c61e3d1e03efad52f1934acb741f037660addfb49898f1d4d2cca8ae3a45b17e607d8029f2101b81ca3c573be8b3d0e009b7d17833cc
- SSDEEP
  
  196608:7WPxRgktJurErvI9pWjgyvoaYrE41JI1DIwoOdho:wgktJurEUWjdo/H1JS1oCho
Score

8^/10

upx discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryexecutionupx

© 2018-2025

Terms | Privacy