Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 12:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6fa7bb05865a2d66b3316e7279e245ec.exe
Resource
win7-20231215-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
6fa7bb05865a2d66b3316e7279e245ec.exe
Resource
win10v2004-20231215-en
7 signatures
150 seconds
General
-
Target
6fa7bb05865a2d66b3316e7279e245ec.exe
-
Size
42KB
-
MD5
6fa7bb05865a2d66b3316e7279e245ec
-
SHA1
18a2cc7739518a1402567b1dc31ee2623f9b474a
-
SHA256
7dfdaf39df5d3fa219ce9f2b88e294357bcdf1fafe57ae674def09f0e20691bd
-
SHA512
44e28e4fdf8dbd181a2a14511627d7ec92e775687b4b8ad2d41b580e52d5177198c85b34daef9e7ceebdd83f5edbbd58a6f86c556a78c46967ef57f768fbc00f
-
SSDEEP
768:L+1rvyjsX6IGS6P8bQ0wLuB2s39BZIjEkApM3bhtNKKjSKgkNGy2Nr:LI3X6ImGQ04sZIjNAa3bEKjSKLNnCr
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-1830\\zaberg.exe" 6fa7bb05865a2d66b3316e7279e245ec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaber0 = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-1830\\zaberg.exe" 6fa7bb05865a2d66b3316e7279e245ec.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1830\Desktop.ini 6fa7bb05865a2d66b3316e7279e245ec.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-1830\\zaberg.exe" 6fa7bb05865a2d66b3316e7279e245ec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2360 set thread context of 2412 2360 6fa7bb05865a2d66b3316e7279e245ec.exe 28 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2412 6fa7bb05865a2d66b3316e7279e245ec.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2412 2360 6fa7bb05865a2d66b3316e7279e245ec.exe 28 PID 2360 wrote to memory of 2412 2360 6fa7bb05865a2d66b3316e7279e245ec.exe 28 PID 2360 wrote to memory of 2412 2360 6fa7bb05865a2d66b3316e7279e245ec.exe 28 PID 2360 wrote to memory of 2412 2360 6fa7bb05865a2d66b3316e7279e245ec.exe 28 PID 2360 wrote to memory of 2412 2360 6fa7bb05865a2d66b3316e7279e245ec.exe 28 PID 2360 wrote to memory of 2412 2360 6fa7bb05865a2d66b3316e7279e245ec.exe 28 PID 2360 wrote to memory of 2412 2360 6fa7bb05865a2d66b3316e7279e245ec.exe 28 PID 2360 wrote to memory of 2412 2360 6fa7bb05865a2d66b3316e7279e245ec.exe 28 PID 2412 wrote to memory of 1196 2412 6fa7bb05865a2d66b3316e7279e245ec.exe 6 PID 2412 wrote to memory of 1196 2412 6fa7bb05865a2d66b3316e7279e245ec.exe 6 PID 2412 wrote to memory of 1196 2412 6fa7bb05865a2d66b3316e7279e245ec.exe 6
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\6fa7bb05865a2d66b3316e7279e245ec.exe"C:\Users\Admin\AppData\Local\Temp\6fa7bb05865a2d66b3316e7279e245ec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\6fa7bb05865a2d66b3316e7279e245ec.exeC:\Users\Admin\AppData\Local\Temp\6fa7bb05865a2d66b3316e7279e245ec.exe3⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops desktop.ini file(s)
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2412
-
-