Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/03/2024, 01:57

General

  • Target

    f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe

  • Size

    161KB

  • MD5

    f44f1d6941436fe095bef7425f850335

  • SHA1

    e442ae7623976fbc3b8bcd1118cdf9bd3ec2d6a3

  • SHA256

    f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9

  • SHA512

    afd084d03ea732dda2a331e4ffd5cbdbed6181649c520cd2a9b9522033eeaf4722b680ac920a666281f8ce6cd20c33aa6f36646e944b8b050973be544a3b850a

  • SSDEEP

    3072:qv5Ls27BIJo7LyXuM/XXXdwVBXXXhYfjCXXXDrXXXDKXXXmfXXXxXXXLIIIBoqfm:qBs27V7LyXf/XXX2VBXXXefjCXXXDrXf

Score
9/10

Malware Config

Signatures

  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe
    "C:\Users\Admin\AppData\Local\Temp\f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F4570A~1.EXE > nul
      2⤵
      • Deletes itself
      PID:1028
  • C:\Windows\Debug\zskhost.exe
    C:\Windows\Debug\zskhost.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    PID:1668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\debug\zskhost.exe

    Filesize

    161KB

    MD5

    91d5eb21d6aa598cc67dcd6e5147639e

    SHA1

    e43735e8fdaf043319d6b72a42f1588fd5750f2f

    SHA256

    9d5634be23ab5fdafd8160e804e829d3105d2863c483907fcba7b79477eb7573

    SHA512

    5d8fe33f304445bd8b38d87bf50a76452f88e24a3d953e296ea9e0ac0afcd08b6c6dee54dac7a22044796be6a2479e52568dce5fcbe785632bbe84b64cd82b71