Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
14/11/2023, 21:54
Behavioral task
behavioral1
Sample
uzisexternal.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
uzisexternal.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
uzisexternal.pyc
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
uzisexternal.pyc
Resource
win10v2004-20231020-en
General
-
Target
uzisexternal.exe
-
Size
20.4MB
-
MD5
3abc9c4db1accd923b9e43de59e1e466
-
SHA1
87b27e608b48942523e390c73106a1177428e43c
-
SHA256
23dd6c27345786926621c5ddb713b8d93b7774b92fd1f78993a8800a536f8c3c
-
SHA512
ce55c9f48af230e88be1378be7425aca46ac40dc2e41da9c1e7af40d4663c92715d3fd6665096106e2be4794b3582ef0613ebac9cd21a687075deaf810659b04
-
SSDEEP
393216:5Wvz+XOVz1ICtL+9qzTfgD7fEUyI7Y/Vt1Wom6:Ez+XOx2A+9q/fq7fEbIypm6
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1288 uzisexternal.exe -
resource yara_rule behavioral1/files/0x00050000000195d3-88.dat upx behavioral1/files/0x00050000000195d3-89.dat upx -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1288 uzisexternal.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2936 wrote to memory of 1288 2936 uzisexternal.exe 28 PID 2936 wrote to memory of 1288 2936 uzisexternal.exe 28 PID 2936 wrote to memory of 1288 2936 uzisexternal.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\uzisexternal.exe"C:\Users\Admin\AppData\Local\Temp\uzisexternal.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\uzisexternal.exe"C:\Users\Admin\AppData\Local\Temp\uzisexternal.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1288
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5552ef97cdbebf443304b7514bb50e950
SHA18d5f5286ee7d4d64ebefb99ea48a5d88ad2e38cc
SHA256888b1eea6ffed7188cb3b82558267fc6fdd3930ea98c9f6801bcb728b02ed538
SHA512c8f0e960831b0bb2bffd5f3d490086002b74499d863488e515d7b755e01e97bc967dce7b211f059ce6046dc6f8f694140456046ba2773903f4b32d7ab38fc325
-
Filesize
1.7MB
MD5552ef97cdbebf443304b7514bb50e950
SHA18d5f5286ee7d4d64ebefb99ea48a5d88ad2e38cc
SHA256888b1eea6ffed7188cb3b82558267fc6fdd3930ea98c9f6801bcb728b02ed538
SHA512c8f0e960831b0bb2bffd5f3d490086002b74499d863488e515d7b755e01e97bc967dce7b211f059ce6046dc6f8f694140456046ba2773903f4b32d7ab38fc325