Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 09:46
Static task
static1
Behavioral task
behavioral1
Sample
0a72173cf92c17b03cc650450650498096866a664750526b093feb3a0adfc7ad.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0a72173cf92c17b03cc650450650498096866a664750526b093feb3a0adfc7ad.exe
Resource
win10v2004-20220812-en
General
-
Target
0a72173cf92c17b03cc650450650498096866a664750526b093feb3a0adfc7ad.exe
-
Size
144KB
-
MD5
20b1c5bcbb9598d68d778a4c5eddd620
-
SHA1
ad03934c5eeda11e93de5ba299c8322f4e44c885
-
SHA256
0a72173cf92c17b03cc650450650498096866a664750526b093feb3a0adfc7ad
-
SHA512
a473607f68a908b8174b214417a7026c02564de8b6f12979a044744c6c00a4cf58319d4a4d759c6de53ff830f46585828e6636dc8becfccf8f7a9f9bd6099e74
-
SSDEEP
3072:MHuG6Xkuwh2ntk2LzSV0aKs+cEBbcJYixDbNSxYi4XIpXuoNw:MOGGS2ntkY1Ac4Dbf4pXuoK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3408 znblaln.exe -
Modifies AppInit DLL entries 2 TTPs
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\Mozilla\czmmuxc.dll znblaln.exe File created C:\PROGRA~3\Mozilla\znblaln.exe 0a72173cf92c17b03cc650450650498096866a664750526b093feb3a0adfc7ad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a72173cf92c17b03cc650450650498096866a664750526b093feb3a0adfc7ad.exe"C:\Users\Admin\AppData\Local\Temp\0a72173cf92c17b03cc650450650498096866a664750526b093feb3a0adfc7ad.exe"1⤵
- Drops file in Program Files directory
PID:4824
-
C:\PROGRA~3\Mozilla\znblaln.exeC:\PROGRA~3\Mozilla\znblaln.exe -irlyaih1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3408
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144KB
MD564157a2d1f4e20f6d17f2c5e4dcb8ee4
SHA1271d9f1a0491e43574fe7030a25eb60142bc146a
SHA256fcdef08594aa0bf45c1bff68dd407bf85f377b5574b63f82ca638f4d326f7161
SHA512ba6a5ec53211f82cae534f060b066717513c66b928765e0017ac0ee95ca226ed17e6cd111091669a799a8fae9659239e0b89816dd8a65b0cc32bd9a8e8ebe9ed
-
Filesize
144KB
MD564157a2d1f4e20f6d17f2c5e4dcb8ee4
SHA1271d9f1a0491e43574fe7030a25eb60142bc146a
SHA256fcdef08594aa0bf45c1bff68dd407bf85f377b5574b63f82ca638f4d326f7161
SHA512ba6a5ec53211f82cae534f060b066717513c66b928765e0017ac0ee95ca226ed17e6cd111091669a799a8fae9659239e0b89816dd8a65b0cc32bd9a8e8ebe9ed