Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
63s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 18:09
Static task
static1
Behavioral task
behavioral1
Sample
caa28fd404cf139d5c8205a36a7764e45c49d60a257a7b5cf3e170c1dc3c56f1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
caa28fd404cf139d5c8205a36a7764e45c49d60a257a7b5cf3e170c1dc3c56f1.exe
Resource
win10v2004-20220901-en
General
-
Target
caa28fd404cf139d5c8205a36a7764e45c49d60a257a7b5cf3e170c1dc3c56f1.exe
-
Size
170KB
-
MD5
1278821e57216c73df687e35c1e78714
-
SHA1
f886c54b552b0c7cddcdc2bc9ac0f5b12c1a7268
-
SHA256
caa28fd404cf139d5c8205a36a7764e45c49d60a257a7b5cf3e170c1dc3c56f1
-
SHA512
9f3ba0a93501affe8a356199d6605d848c34c3a56564d8b09ada07b7627de29e1966dc3d00cf742d5c2b210910ab7899aadbf9c9e85af9b725001e4f225b6ad4
-
SSDEEP
3072:T7zy6o1J5KnjGO+uMqlSYAbnHyZKcZ0idKGSQQRbABg:faO+uMqMnHyYKdU
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1136 Zcokea.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run Zcokea.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\UBC5AB1IDP = "C:\\Windows\\Zcokea.exe" Zcokea.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Zcokea.exe caa28fd404cf139d5c8205a36a7764e45c49d60a257a7b5cf3e170c1dc3c56f1.exe File created C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job caa28fd404cf139d5c8205a36a7764e45c49d60a257a7b5cf3e170c1dc3c56f1.exe File opened for modification C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job caa28fd404cf139d5c8205a36a7764e45c49d60a257a7b5cf3e170c1dc3c56f1.exe File created C:\Windows\Zcokea.exe caa28fd404cf139d5c8205a36a7764e45c49d60a257a7b5cf3e170c1dc3c56f1.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International Zcokea.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe 1136 Zcokea.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1928 caa28fd404cf139d5c8205a36a7764e45c49d60a257a7b5cf3e170c1dc3c56f1.exe 1136 Zcokea.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1928 wrote to memory of 1136 1928 caa28fd404cf139d5c8205a36a7764e45c49d60a257a7b5cf3e170c1dc3c56f1.exe 26 PID 1928 wrote to memory of 1136 1928 caa28fd404cf139d5c8205a36a7764e45c49d60a257a7b5cf3e170c1dc3c56f1.exe 26 PID 1928 wrote to memory of 1136 1928 caa28fd404cf139d5c8205a36a7764e45c49d60a257a7b5cf3e170c1dc3c56f1.exe 26 PID 1928 wrote to memory of 1136 1928 caa28fd404cf139d5c8205a36a7764e45c49d60a257a7b5cf3e170c1dc3c56f1.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\caa28fd404cf139d5c8205a36a7764e45c49d60a257a7b5cf3e170c1dc3c56f1.exe"C:\Users\Admin\AppData\Local\Temp\caa28fd404cf139d5c8205a36a7764e45c49d60a257a7b5cf3e170c1dc3c56f1.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\Zcokea.exeC:\Windows\Zcokea.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1136
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408B
MD5176d43177763b9ac96fceabcdce11957
SHA1a132a561b5652b879ddd4a903f3b6c2dd06ea301
SHA2563958b6c2c87d9aa3c83fafe108ec1997731fae7723febbb6389d54f5bb8bd42c
SHA5124eaf04157c4aa793834a5a7a056d970495527eb2f1a9fe3c8af6fa10ac595be56cf9ca24c1c0db30741504b5528acb143a2e7ff554ceb9b5db75b0b4700dcb1f
-
Filesize
170KB
MD51278821e57216c73df687e35c1e78714
SHA1f886c54b552b0c7cddcdc2bc9ac0f5b12c1a7268
SHA256caa28fd404cf139d5c8205a36a7764e45c49d60a257a7b5cf3e170c1dc3c56f1
SHA5129f3ba0a93501affe8a356199d6605d848c34c3a56564d8b09ada07b7627de29e1966dc3d00cf742d5c2b210910ab7899aadbf9c9e85af9b725001e4f225b6ad4