Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
18/02/2024, 06:12
General
-
Target
fe6157ea3ff94f6c4f84da31a56ea05038dba490cc441bac0086999456170d18.exe
-
Size
7.8MB
-
MD5
49db7b3e827ab7d47b9106f924cf0d08
-
SHA1
0c8d26a2e408bb4efbe6c64d38c21cf85cafdf24
-
SHA256
fe6157ea3ff94f6c4f84da31a56ea05038dba490cc441bac0086999456170d18
-
SHA512
a42ce8949b1e69a3131ec0e6ef12e7fb5f918a716fe7f91539c05a11a5cc78ea408e9e32afa7468d4d440630c4ef870b2758014b42cbf0932048d71ef5dc92fc
-
SSDEEP
98304:ceidhlFrjrskTaHuZXVoYWJKxNOJmrOw4/M1mfxjXem5t:8nFrjaHKLCmrOMofxjfH
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe6157ea3ff94f6c4f84da31a56ea05038dba490cc441bac0086999456170d18.exe"C:\Users\Admin\AppData\Local\Temp\fe6157ea3ff94f6c4f84da31a56ea05038dba490cc441bac0086999456170d18.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ZMining.exe"C:\Users\Admin\AppData\Local\Temp\ZMining.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.0MB
MD572d96b353837f5166d4c0a4fa7170999
SHA1350c23eee9202aa0d514282b1c27defeafa5feef
SHA25697684c587ad0f00b52d18ea4aebe836a25cbfcf115f47c69cb592496293e9468
SHA51279e7153f305f43624a5a7d3fe1b70b689fdc2e4f7f5f9890399c3ae540db323baabeee86272a179fcca0bfd6785794caeee23b1da37cb3479f0dd1fc887c9c36
-
Filesize
768KB
MD5de8ede853f24a07168c1a6b2c1dbebf3
SHA19a809b161200a5555d6f30f87cf94434b239501c
SHA25604f2748207ab180e125a548529c910cd390bca6992dda29ef82c7f8518b3c094
SHA512e6dd05d10f6da4905bb9f5dd0bae5a4191a7ef6c929baa2aeec5f11844844c4427fbe97b93706a549b67103a0b81124953041537c416135d0e5721b9e85c2d18
-
Filesize
597KB
MD5ba5b566449f3e4429aa10d9374fff22a
SHA167d882218b32bb34ff346ce250f1881cacedda32
SHA2562d2f7e096925f8534f050118b9e3e78e505d41d96a1a2a8c3527dffe8d1cb50f
SHA5126dec2530bbadc3d34b4b7779769a3ada244314f610a53bddbeed3e2265e18acdfb96546183fbb840b4017a9e88ff284cd5802930b05fc76e5cbcfb2e825588ac
-
Filesize
4KB
-
Filesize
7.9MB
-
Filesize
4KB
-
Filesize
7.9MB
-
Filesize
16.1MB
-
Filesize
4KB
-
Filesize
16.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.1MB
-
Filesize
16.1MB
-
Filesize
4KB
-
Filesize
16.1MB
-
Filesize
16.1MB
-
Filesize
16.1MB
-
Filesize
16.1MB