Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    82s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 20:08

General

  • Target

    eb0b0aae02cdb9b7e089c1777c8b0812684999f0ad2494c8a7cb03c1654cdd6c.exe

  • Size

    152KB

  • MD5

    fad644ff815a163062309b3f4c921e8d

  • SHA1

    c0fcdfc18dfbaddf439c582e5661887d5bde0d14

  • SHA256

    eb0b0aae02cdb9b7e089c1777c8b0812684999f0ad2494c8a7cb03c1654cdd6c

  • SHA512

    603434458633d95b084ad3876c5445a5b840e7a211b6aa9fcc99ab9e84ccd292f050f0101eb17af756426c4b70ad1c2772acbe0458c260d94551cddcb7486acb

  • SSDEEP

    3072:Urdsw3SLk8KvAmRPveYlUq/kzPi0gEr+YsBYPAZ1KHiLwcIaZ154oQZiEkV:ACLrEGaUq8iHEXsCJR8ZdWs

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 53 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb0b0aae02cdb9b7e089c1777c8b0812684999f0ad2494c8a7cb03c1654cdd6c.exe
    "C:\Users\Admin\AppData\Local\Temp\eb0b0aae02cdb9b7e089c1777c8b0812684999f0ad2494c8a7cb03c1654cdd6c.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1772
    • C:\Users\Admin\zaiasu.exe
      "C:\Users\Admin\zaiasu.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1076

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\zaiasu.exe

    Filesize

    152KB

    MD5

    68bf949fae3ad8cc31856386203feb33

    SHA1

    06180d0b6b5812acc0ed950abd5f4a18c1477d89

    SHA256

    d1a38342e8dcf443d4fa6b2fb2315b664f0bab5b510b95f18475d6b47c90a735

    SHA512

    27e3f9ccccd045aba73ba602838a2f68217f897284e4aa948de19c5449b377077e945a76ef250e963f705988b90848a642c2f5bbc8f332e8c05c185178b7f0aa

  • C:\Users\Admin\zaiasu.exe

    Filesize

    152KB

    MD5

    68bf949fae3ad8cc31856386203feb33

    SHA1

    06180d0b6b5812acc0ed950abd5f4a18c1477d89

    SHA256

    d1a38342e8dcf443d4fa6b2fb2315b664f0bab5b510b95f18475d6b47c90a735

    SHA512

    27e3f9ccccd045aba73ba602838a2f68217f897284e4aa948de19c5449b377077e945a76ef250e963f705988b90848a642c2f5bbc8f332e8c05c185178b7f0aa

  • \Users\Admin\zaiasu.exe

    Filesize

    152KB

    MD5

    68bf949fae3ad8cc31856386203feb33

    SHA1

    06180d0b6b5812acc0ed950abd5f4a18c1477d89

    SHA256

    d1a38342e8dcf443d4fa6b2fb2315b664f0bab5b510b95f18475d6b47c90a735

    SHA512

    27e3f9ccccd045aba73ba602838a2f68217f897284e4aa948de19c5449b377077e945a76ef250e963f705988b90848a642c2f5bbc8f332e8c05c185178b7f0aa

  • \Users\Admin\zaiasu.exe

    Filesize

    152KB

    MD5

    68bf949fae3ad8cc31856386203feb33

    SHA1

    06180d0b6b5812acc0ed950abd5f4a18c1477d89

    SHA256

    d1a38342e8dcf443d4fa6b2fb2315b664f0bab5b510b95f18475d6b47c90a735

    SHA512

    27e3f9ccccd045aba73ba602838a2f68217f897284e4aa948de19c5449b377077e945a76ef250e963f705988b90848a642c2f5bbc8f332e8c05c185178b7f0aa

  • memory/1772-56-0x0000000075981000-0x0000000075983000-memory.dmp

    Filesize

    8KB