Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
07/10/2023, 08:17
Behavioral task
behavioral1
Sample
09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe
Resource
win10v2004-20230915-en
General
-
Target
09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe
-
Size
823KB
-
MD5
b255c4c0c3379db4b2afe207c90aad92
-
SHA1
1b746283ad6e2a538048526d6bfe2ca044cc7963
-
SHA256
09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2
-
SHA512
067c05f1ba932e4658856afe4013eb4b30a0a3e7559cb52c481bc975e69903c06ebabd44cc89ce6e821cb4bf746216e23177ca98c975f1a0bd18328f217e3ec3
-
SSDEEP
24576:iGiZm/gubF8j51far6VJ+xcVW9zh7afqxs1OVTcsBvwnmkvqPo0lTs:i8/LLZrlTs
Malware Config
Signatures
-
Detect Blackmoon payload 5 IoCs
resource yara_rule behavioral1/memory/2520-2-0x0000000000400000-0x00000000004E5000-memory.dmp family_blackmoon behavioral1/memory/2520-1-0x0000000000400000-0x00000000004E5000-memory.dmp family_blackmoon behavioral1/memory/2520-5-0x0000000000400000-0x00000000004E5000-memory.dmp family_blackmoon behavioral1/memory/2520-10-0x0000000000400000-0x00000000004E5000-memory.dmp family_blackmoon behavioral1/memory/2520-11-0x0000000000400000-0x00000000004E5000-memory.dmp family_blackmoon -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\zixuxs\ImagePath = "\\??\\C:\\Windows\\Fonts\\zixuxs.sys" 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe -
Stops running service(s) 3 TTPs
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Fonts\zixuxs.sys 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe File opened for modification C:\Windows\Fonts\zixuxs.sys 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2664 sc.exe 2584 sc.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2520 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe 2520 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe 2520 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe 2520 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe 2520 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe 2520 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe 2520 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe 2520 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 468 Process not Found 468 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2520 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe 2520 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2588 2520 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe 28 PID 2520 wrote to memory of 2588 2520 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe 28 PID 2520 wrote to memory of 2588 2520 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe 28 PID 2520 wrote to memory of 2588 2520 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe 28 PID 2588 wrote to memory of 2664 2588 CMD.exe 30 PID 2588 wrote to memory of 2664 2588 CMD.exe 30 PID 2588 wrote to memory of 2664 2588 CMD.exe 30 PID 2588 wrote to memory of 2664 2588 CMD.exe 30 PID 2520 wrote to memory of 2708 2520 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe 31 PID 2520 wrote to memory of 2708 2520 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe 31 PID 2520 wrote to memory of 2708 2520 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe 31 PID 2520 wrote to memory of 2708 2520 09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe 31 PID 2708 wrote to memory of 2584 2708 CMD.exe 33 PID 2708 wrote to memory of 2584 2708 CMD.exe 33 PID 2708 wrote to memory of 2584 2708 CMD.exe 33 PID 2708 wrote to memory of 2584 2708 CMD.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe"C:\Users\Admin\AppData\Local\Temp\09b5debc4bd0e7760ba7bf6faa93268285cafa004608fe2735cba1b6eb0836a2.exe"1⤵
- Sets service image path in registry
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\CMD.exeCMD /C SC STOP zixuxs2⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\sc.exeSC STOP zixuxs3⤵
- Launches sc.exe
PID:2664
-
-
-
C:\Windows\SysWOW64\CMD.exeCMD /C SC DELETE zixuxs2⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\sc.exeSC DELETE zixuxs3⤵
- Launches sc.exe
PID:2584
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1