Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 11:39
Behavioral task
behavioral1
Sample
f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de.exe
Resource
win10v2004-20220901-en
General
-
Target
f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de.exe
-
Size
249KB
-
MD5
2b82893a9dcb25fd752ed810c2e95c88
-
SHA1
65220d72910a7059401a312c503d07c239b23b23
-
SHA256
f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de
-
SHA512
fb1ccae8fe534f3858aea6fb93f94e1c5acef333016e9199300688a0736f5dfb9313f1d1ff6a871eab3cc416eb0a2c6bcfd31a74c6eb70cbad5b42491872af0b
-
SSDEEP
6144:I5OuRiaa832T8oBCP4l0X6J6oHfY6aFTH27CHXVJGS8msd5YxG6jL:NuRvn3M8vX6f/taFTW7sXDw5oL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1576 zmd67tm4.exe -
resource yara_rule behavioral1/files/0x00080000000142c0-56.dat upx behavioral1/files/0x00080000000142c0-58.dat upx behavioral1/files/0x00080000000142c0-65.dat upx -
Loads dropped DLL 1 IoCs
pid Process 1672 f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\zmd67tm4.exe = "C:\\Users\\Admin\\AppData\\Roaming\\zmd67tm4.exe" f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main zmd67tm4.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch zmd67tm4.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" zmd67tm4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe 1576 zmd67tm4.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1576 zmd67tm4.exe 1576 zmd67tm4.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1672 wrote to memory of 1576 1672 f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de.exe 27 PID 1672 wrote to memory of 1576 1672 f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de.exe 27 PID 1672 wrote to memory of 1576 1672 f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de.exe 27 PID 1672 wrote to memory of 1576 1672 f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de.exe"C:\Users\Admin\AppData\Local\Temp\f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Roaming\zmd67tm4.exe"C:\Users\Admin\AppData\Roaming\zmd67tm4.exe"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1576
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8B
MD55bcbe1ecc2edff92295f615f3eb43e6c
SHA13c647f8990e643571d6a7fced46552b12d43550c
SHA2568452d2e8d0f1501c70484431907f86c5ad33103676754bae69ec082b31d64260
SHA5120c9f6d3ba60ead2feae76918dfd3c254314c1c4c8252d89bf24e38651dd0174b2f0a70af846c3a58d73953f5286e43f35cfe03c07ba886cc9014737ebd06d19f
-
Filesize
249KB
MD52b82893a9dcb25fd752ed810c2e95c88
SHA165220d72910a7059401a312c503d07c239b23b23
SHA256f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de
SHA512fb1ccae8fe534f3858aea6fb93f94e1c5acef333016e9199300688a0736f5dfb9313f1d1ff6a871eab3cc416eb0a2c6bcfd31a74c6eb70cbad5b42491872af0b
-
Filesize
249KB
MD52b82893a9dcb25fd752ed810c2e95c88
SHA165220d72910a7059401a312c503d07c239b23b23
SHA256f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de
SHA512fb1ccae8fe534f3858aea6fb93f94e1c5acef333016e9199300688a0736f5dfb9313f1d1ff6a871eab3cc416eb0a2c6bcfd31a74c6eb70cbad5b42491872af0b
-
Filesize
249KB
MD52b82893a9dcb25fd752ed810c2e95c88
SHA165220d72910a7059401a312c503d07c239b23b23
SHA256f326dd1b2d845308e3b18e9228f55cde34ef33095e2c344bb34616ebdf38d4de
SHA512fb1ccae8fe534f3858aea6fb93f94e1c5acef333016e9199300688a0736f5dfb9313f1d1ff6a871eab3cc416eb0a2c6bcfd31a74c6eb70cbad5b42491872af0b