Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 12:46

General

  • Target

    1f86a188e113abd36d93f13f5ec8226d.exe

  • Size

    240KB

  • MD5

    1f86a188e113abd36d93f13f5ec8226d

  • SHA1

    30c60924ff5f9a9b7e90a532cb477a804493cbbf

  • SHA256

    8e16599b03092046a826a79d53e47d2fa5c8fbfb1e9d78a3ab5b43245350187c

  • SHA512

    8a7ea14ba9d7adbb530e6fa23d99af64848ced73f6d7196ed3b4a7f55349a7426aa8f779dbd236d9c2a1939a13f5dc2b7361da37560055c92858e9c5dbf07a4b

  • SSDEEP

    6144:fUB3dwqsNwemAB0EqxF6snji81RUinKchhytS3n:0dQQJsU3

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f86a188e113abd36d93f13f5ec8226d.exe
    "C:\Users\Admin\AppData\Local\Temp\1f86a188e113abd36d93f13f5ec8226d.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Users\Admin\ziinee.exe
      "C:\Users\Admin\ziinee.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2144

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\ziinee.exe

    Filesize

    240KB

    MD5

    741e7aafac104ffa82a6fabded769d6a

    SHA1

    ba5d2c1ac4bbec773ef64db091f553e143fb6921

    SHA256

    e012e6b2104ecb30bd08fe9dc46dce75f05c809643a0a46d4bfa6731ca90f5d5

    SHA512

    0273cde2c18126b86fcc190479406cda6a32906df603961d9e4db4967c71629da45ff7e4f4ce8e3eda046ae8c228960e2d31a0c1ceef0debf94adf40ea891025

  • \Users\Admin\ziinee.exe

    Filesize

    65KB

    MD5

    5fd8d567c44c25793832a6b7fbf49fe7

    SHA1

    8976cd00a4d59c127e277cc448fcbc34f84760ba

    SHA256

    b3abdeacef21ac46fb53bb20056186ccfcf9e5716a3acc6c0b77cf733b5223a9

    SHA512

    88a3585f583af5b1e7d88e5e4ffaacde7f213453d0695483cd68a3c500114bd8cad08273a39c2dd66a6b2a2472e8d54b9151894e32bfdca2575283e7249610bc