Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/03/2024, 17:47
Static task
static1
Behavioral task
behavioral1
Sample
b54a96e40b86f3af78bad24e9e3cf579.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b54a96e40b86f3af78bad24e9e3cf579.exe
Resource
win10v2004-20240226-en
General
-
Target
b54a96e40b86f3af78bad24e9e3cf579.exe
-
Size
48KB
-
MD5
b54a96e40b86f3af78bad24e9e3cf579
-
SHA1
d26251f4d8687e5394b0c9c75044e3009e1db472
-
SHA256
2588d897f60a7b5d9f74332d7078b4abd9152844ff039292d5e2dc81652ca09c
-
SHA512
53425a5f6b14755956cdca51e2c7df8998eeb184d8ed788eaa052ed6529b9beb24d9b91aed428802be150581129768dc4ff5fbaed0c414538c1cc3458ca60106
-
SSDEEP
768:EyW1yBtObv0U/xwPp0EoooiYECG2nZF5sZVcmxX:24Bobv7aB0EooYEC3rUVcYX
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2996 zbhnd.exe -
Loads dropped DLL 1 IoCs
pid Process 1524 b54a96e40b86f3af78bad24e9e3cf579.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1524 wrote to memory of 2996 1524 b54a96e40b86f3af78bad24e9e3cf579.exe 28 PID 1524 wrote to memory of 2996 1524 b54a96e40b86f3af78bad24e9e3cf579.exe 28 PID 1524 wrote to memory of 2996 1524 b54a96e40b86f3af78bad24e9e3cf579.exe 28 PID 1524 wrote to memory of 2996 1524 b54a96e40b86f3af78bad24e9e3cf579.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\b54a96e40b86f3af78bad24e9e3cf579.exe"C:\Users\Admin\AppData\Local\Temp\b54a96e40b86f3af78bad24e9e3cf579.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"2⤵
- Executes dropped EXE
PID:2996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD557674243a1b86e7adaa1a12abbefee2d
SHA1977c314c397e986d8b9350adace9fe7a87021f66
SHA2566933e3f6beb90d30a21e654ab838563389fa42f17475cb969006f2d484081e18
SHA51207cfcd6c7f593f7b777fe403d5b4daf57d8d50e4e83b92f845d3aa9f02f251565117143e43870ff821578ad346bfc11b32de942207dd5efc2dd2ed645725208e