Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 12:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6fa7bb05865a2d66b3316e7279e245ec.exe
Resource
win7-20231215-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
6fa7bb05865a2d66b3316e7279e245ec.exe
Resource
win10v2004-20231215-en
7 signatures
150 seconds
General
-
Target
6fa7bb05865a2d66b3316e7279e245ec.exe
-
Size
42KB
-
MD5
6fa7bb05865a2d66b3316e7279e245ec
-
SHA1
18a2cc7739518a1402567b1dc31ee2623f9b474a
-
SHA256
7dfdaf39df5d3fa219ce9f2b88e294357bcdf1fafe57ae674def09f0e20691bd
-
SHA512
44e28e4fdf8dbd181a2a14511627d7ec92e775687b4b8ad2d41b580e52d5177198c85b34daef9e7ceebdd83f5edbbd58a6f86c556a78c46967ef57f768fbc00f
-
SSDEEP
768:L+1rvyjsX6IGS6P8bQ0wLuB2s39BZIjEkApM3bhtNKKjSKgkNGy2Nr:LI3X6ImGQ04sZIjNAa3bEKjSKLNnCr
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-1830\\zaberg.exe" 6fa7bb05865a2d66b3316e7279e245ec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaber0 = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-1830\\zaberg.exe" 6fa7bb05865a2d66b3316e7279e245ec.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1830\Desktop.ini 6fa7bb05865a2d66b3316e7279e245ec.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-1830\\zaberg.exe" 6fa7bb05865a2d66b3316e7279e245ec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2084 set thread context of 2772 2084 6fa7bb05865a2d66b3316e7279e245ec.exe 91 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2772 6fa7bb05865a2d66b3316e7279e245ec.exe 2772 6fa7bb05865a2d66b3316e7279e245ec.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2772 2084 6fa7bb05865a2d66b3316e7279e245ec.exe 91 PID 2084 wrote to memory of 2772 2084 6fa7bb05865a2d66b3316e7279e245ec.exe 91 PID 2084 wrote to memory of 2772 2084 6fa7bb05865a2d66b3316e7279e245ec.exe 91 PID 2084 wrote to memory of 2772 2084 6fa7bb05865a2d66b3316e7279e245ec.exe 91 PID 2084 wrote to memory of 2772 2084 6fa7bb05865a2d66b3316e7279e245ec.exe 91 PID 2084 wrote to memory of 2772 2084 6fa7bb05865a2d66b3316e7279e245ec.exe 91 PID 2084 wrote to memory of 2772 2084 6fa7bb05865a2d66b3316e7279e245ec.exe 91 PID 2772 wrote to memory of 3536 2772 6fa7bb05865a2d66b3316e7279e245ec.exe 40 PID 2772 wrote to memory of 3536 2772 6fa7bb05865a2d66b3316e7279e245ec.exe 40 PID 2772 wrote to memory of 3536 2772 6fa7bb05865a2d66b3316e7279e245ec.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fa7bb05865a2d66b3316e7279e245ec.exe"C:\Users\Admin\AppData\Local\Temp\6fa7bb05865a2d66b3316e7279e245ec.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\6fa7bb05865a2d66b3316e7279e245ec.exeC:\Users\Admin\AppData\Local\Temp\6fa7bb05865a2d66b3316e7279e245ec.exe2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops desktop.ini file(s)
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2772
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3536