Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

zombe-free.exe

windows7-x64

7

zombe-free.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    130s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    19/03/2023, 05:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    zombe-free.exe

  • Size

    12.3MB

  • MD5

    08597eca69010dec96b4de0ede2adb79

  • SHA1

    3b66c915f2b81b01bc20c30950dd5b9f934f40d4

  • SHA256

    ef3eb26586923bd38c5eebcef9207896ea641222872eaafa088abacb8fa9c408

  • SHA512

    314ece959c229825e4b40c31467dc72f36512cb985eee31c56bd62423f8e325164aa2bf7bd4d55f2e88f1d9eb1f7ea25f65bcb0c29facb706c57be5349f85ed3

  • SSDEEP

    196608:j4u78K/FjDRIwd9ZaFTLXgHxbAQvBwejuJDUX47dwdW0DW9Bjjl8urNYPJkfhptV:Mu7L/FD/wFuxZaUX47d4LO8UNp1QC

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\zombe-free.exe
    "C:\Users\Admin\AppData\Local\Temp\zombe-free.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Users\Admin\AppData\Local\Temp\zombe-free.exe
      "C:\Users\Admin\AppData\Local\Temp\zombe-free.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI17322\python311.dll
    Filesize

    5.5MB

    MD5

    1fe47c83669491bf38a949253d7d960f

    SHA1

    de5cc181c0e26cbcb31309fe00d9f2f5264d2b25

    SHA256

    0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae

    SHA512

    05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI17322\python311.dll
    Filesize

    5.5MB

    MD5

    1fe47c83669491bf38a949253d7d960f

    SHA1

    de5cc181c0e26cbcb31309fe00d9f2f5264d2b25

    SHA256

    0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae

    SHA512

    05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4

    Download Submit