Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 20:00
Static task
static1
Behavioral task
behavioral1
Sample
027a371ca62041fa8569e38f222a47c0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
027a371ca62041fa8569e38f222a47c0.exe
Resource
win10v2004-20231215-en
General
-
Target
027a371ca62041fa8569e38f222a47c0.exe
-
Size
22.3MB
-
MD5
027a371ca62041fa8569e38f222a47c0
-
SHA1
02ac81b1a98cc166e761790e2f8ad1096dbc1f67
-
SHA256
adac839107c90a7edc0ac06c75a682f6fe1343f968e5dc8f20c7907c24406d45
-
SHA512
1d17bfbc5a69b90ad31e4d93c54459413480d890ff166640bf46d697e8a1f99208e179c4e13daf4d2e19f7ee83bb863e5ae3a7bada3df4b1d15eed43fadee56a
-
SSDEEP
98304:EcKH5J2HhH5JZq2HhH5iH5JZE5iH5JZ6NHhH5JZq2HhH5iH5JZE5i:E
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2620 zvqlex.exe -
Loads dropped DLL 2 IoCs
pid Process 2332 027a371ca62041fa8569e38f222a47c0.exe 2332 027a371ca62041fa8569e38f222a47c0.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main zvqlex.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2620 zvqlex.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2620 zvqlex.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2620 zvqlex.exe 2620 zvqlex.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2620 2332 027a371ca62041fa8569e38f222a47c0.exe 27 PID 2332 wrote to memory of 2620 2332 027a371ca62041fa8569e38f222a47c0.exe 27 PID 2332 wrote to memory of 2620 2332 027a371ca62041fa8569e38f222a47c0.exe 27 PID 2332 wrote to memory of 2620 2332 027a371ca62041fa8569e38f222a47c0.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\027a371ca62041fa8569e38f222a47c0.exe"C:\Users\Admin\AppData\Local\Temp\027a371ca62041fa8569e38f222a47c0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\zvqlex.exeC:\Users\Admin\AppData\Local\Temp\zvqlex.exe -run C:\Users\Admin\AppData\Local\Temp\027a371ca62041fa8569e38f222a47c0.exe2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5327be1fbd55b2f98bde5216fbe15a179
SHA10b98faad1fafeca05258dcdef34f3e7c0598673c
SHA2563958d0905a173c8640ababf6f30bbf74ee110299684ba04acbd07aa1a03408cb
SHA512320fc795d805ae119759e30311306beef3354bd3b976a955c6a81ccb2f4932154c04b5b1f29db65d06aa24554779f2b7f338fbc940ab2aacb06c0b5b2af5ca01
-
Filesize
33KB
MD55d3c4d3a542ae9c14648fe69ee71a723
SHA1629c30a08f60bcbe9c38d595d1963acf53162f31
SHA256a0beb83880b98306462f65754471b888688c267d5717806d7582092d820ac889
SHA512539539cb60e7ecd4f44b48d85c0d232d96a977f6956d9dfce6afbc65750b96a26efa7d984198352853b0ea7abd79b8cbfe33585284cfe5307b95c6adbf8193bf
-
Filesize
23KB
MD5055af2c870fb6a6e47c05ff0589b61e5
SHA1ef924e1f5a6477c5c48dd1edbbcc376c8fccb559
SHA2562e89dfe430967d6c56e8b7ffc8cde9faa4f3cc84df60b2747ca0b2c718a239f9
SHA51289969f7e63fb2be768076c260635a2353d17e5cf765cc27821c4fd78acec9b37b1427ec3797956637dd8558acdcfe9169601001c11aa09424b98cec18114ac79
-
Filesize
45KB
MD516cc1342ad5516773c2d755a26dbe78d
SHA1c2f1e58c768bfb565e326f80075065c50fe0d9b1
SHA256b85270df4583aaaef078e4a69ad25b71273d7e955d98904e7637e5ddff4ec65a
SHA51226ce3bb82fd78a351f8961863e7d3f9c4a4c148beb5e86451c73cdfc76c3e8cbeaf9fa2523f103094b837d5ae980edda3afd033b0a348d758c101b79c8f18267
-
Filesize
65KB
MD581ea152f2ab7d16931d448332c7a1d5c
SHA15dedffc3454d04eadd5e1c580e2234332627f483
SHA256e6f7f6768fc068e036c994b6a30fd9aa832c6f38be288e74c00ed12359baec97
SHA5121af609e0889fe7b595ac546d0dbab250e930e684b0680f200c372d26ab65de2c0efea1787fa8dab67fe448fe623fd00987d946d4af8d833c600b7534bb837917