Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
58s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 01:43
Behavioral task
behavioral1
Sample
d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe
Resource
win7-20221111-en
General
-
Target
d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe
-
Size
95KB
-
MD5
deb6eacef0a8347451df11ab8b3f60c1
-
SHA1
6d32f61a0aa794a0c0ac77504fec458eb1abc4b8
-
SHA256
d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c
-
SHA512
6afc2b318166951566f2e330e06fc19a6b5df056a997d62147a7794d2f31df40a68181b44e40ef7dfcc426601007b37e647e3db009dbeb65a09ff58e0428248b
-
SSDEEP
1536:ivQbT1ceTu9hqY823riQqmGNkyYjdR633o2QOtHckyJikTX3MnKeDpgp94cuo4R:iKhGqr23riTHNadRw3o2QRJikTHM562U
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1188-54-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1188-57-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1188-61-0x0000000000400000-0x000000000041F000-memory.dmp upx -
resource yara_rule behavioral1/files/0x00070000000132f2-55.dat vmprotect behavioral1/files/0x00070000000132f2-58.dat vmprotect -
Deletes itself 1 IoCs
pid Process 1536 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 1188 d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe 1188 d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\zlerjb1.dat d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe File created C:\Windows\SysWOW64\zlerjb1.dat d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe File created C:\Windows\SysWOW64\zlerjb2.dat d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe File opened for modification C:\Windows\SysWOW64\zlerjb4.dat d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe File opened for modification C:\Windows\SysWOW64\zlerjb5.dat d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe File created C:\Windows\SysWOW64\zlerjb5.dat d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe File opened for modification C:\Windows\SysWOW64\zlerjb2.dat d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe File opened for modification C:\Windows\SysWOW64\zlerjb3.dat d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe File created C:\Windows\SysWOW64\zlerjb3.dat d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe File created C:\Windows\SysWOW64\zlerjb4.dat d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\jvodskvm\idxwqfcky.dll d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1188 d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe -
Suspicious behavior: LoadsDriver 4 IoCs
pid Process 1188 d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe 460 Process not Found 1188 d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe 460 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLoadDriverPrivilege 1188 d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe Token: SeLoadDriverPrivilege 1188 d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1188 d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1188 wrote to memory of 1536 1188 d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe 28 PID 1188 wrote to memory of 1536 1188 d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe 28 PID 1188 wrote to memory of 1536 1188 d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe 28 PID 1188 wrote to memory of 1536 1188 d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe"C:\Users\Admin\AppData\Local\Temp\d98bdf19587790f2d1ef81f35a242c05b0e160741fe07a6b4210953703e6d87c.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\D98BDF~1.EXE2⤵
- Deletes itself
PID:1536
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5ee0ed1e2d452c31965d3875c9b14de71
SHA17092e40a68001e7202024c32119970d5175ed027
SHA256caea75f95fe6ffc81e5574b03f5fb440edf20b400a5937a9d46df323761357f6
SHA51286c941b97392617a728a9f29ce0da4d8410b1bc92d47cc733f514054c8e46b7a22e8c59c9c3df81d92e3926b371fa17be841b60ceeb68b0c3aa47583b4920a4d
-
Filesize
93KB
MD5ee0ed1e2d452c31965d3875c9b14de71
SHA17092e40a68001e7202024c32119970d5175ed027
SHA256caea75f95fe6ffc81e5574b03f5fb440edf20b400a5937a9d46df323761357f6
SHA51286c941b97392617a728a9f29ce0da4d8410b1bc92d47cc733f514054c8e46b7a22e8c59c9c3df81d92e3926b371fa17be841b60ceeb68b0c3aa47583b4920a4d