Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    26s
  • max time network
    42s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2022, 00:53

General

  • Target

    2a83a871b43545ff86640c2ae36bd3b64903f850dfd5ccc97acbe52b1f63839d.exe

  • Size

    162KB

  • MD5

    0ac18ae1df521bfb9b1a4cc4d2cbb170

  • SHA1

    00b374204fd8effefbaa0ca002cc05a79d0f765d

  • SHA256

    2a83a871b43545ff86640c2ae36bd3b64903f850dfd5ccc97acbe52b1f63839d

  • SHA512

    253ddc30c960dafb407a11a5c70e5a8e3e1c290452d3c74892954d9c9859a6c87c82362b945f462b3240e4977c3bc4362484df901ee4196b4fc1865e58a57f7b

  • SSDEEP

    3072:ZliwDUWyFcB9fu+JMl2uU82Ws7f9sjboPACTQembG4hY/i1vAE:ZldD1Yc7GIBgbzjbfLhRWE

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a83a871b43545ff86640c2ae36bd3b64903f850dfd5ccc97acbe52b1f63839d.exe
    "C:\Users\Admin\AppData\Local\Temp\2a83a871b43545ff86640c2ae36bd3b64903f850dfd5ccc97acbe52b1f63839d.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1968
  • C:\PROGRA~3\Mozilla\znblaln.exe
    C:\PROGRA~3\Mozilla\znblaln.exe -irlyaih
    1⤵
    • Executes dropped EXE
    PID:2132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~3\Mozilla\znblaln.exe

    Filesize

    36KB

    MD5

    fb978e02e51b203e2e94e3dee049b971

    SHA1

    e090afdc4da2ae8c734b0a82a2af007425481b54

    SHA256

    c01e72ec6a0628dcc013180541e4bea96ace8808dc5ff962cb8ab06e9e40afd9

    SHA512

    d13bb15f31961547943ca218905ae900966c9986f9ca696d8a351fe08a333db538982172c6401cdc2d63da8ea2fadd2b6b2ddcbdd3f300d3f43b2de791b54cae

  • C:\ProgramData\Mozilla\znblaln.exe

    Filesize

    35KB

    MD5

    56951f01eb9356d1e67d7de269f2141e

    SHA1

    b8d0a68dbecb94ba3244a693f782aaa52f47f97c

    SHA256

    f23f5241041be27852b7774bfbc4bcfcb1f5767cc65d432d2216eeb7eed134e3

    SHA512

    47439159fc813ca88d8f1f35c07e0fe1fcfea4c6109ad44e3f729f73b8394e67f39a0f07ecd3ab4e26f4e301b610ff811b216f670db89e454ab5d81150d82610

  • memory/1968-132-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/1968-133-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/1968-134-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/1968-137-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2132-140-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2132-141-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2132-142-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2132-145-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB