Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 01:57
Static task
static1
Behavioral task
behavioral1
Sample
f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe
Resource
win10v2004-20240226-en
General
-
Target
f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe
-
Size
161KB
-
MD5
f44f1d6941436fe095bef7425f850335
-
SHA1
e442ae7623976fbc3b8bcd1118cdf9bd3ec2d6a3
-
SHA256
f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9
-
SHA512
afd084d03ea732dda2a331e4ffd5cbdbed6181649c520cd2a9b9522033eeaf4722b680ac920a666281f8ce6cd20c33aa6f36646e944b8b050973be544a3b850a
-
SSDEEP
3072:qv5Ls27BIJo7LyXuM/XXXdwVBXXXhYfjCXXXDrXXXDKXXXmfXXXxXXXLIIIBoqfm:qBs27V7LyXf/XXX2VBXXXefjCXXXDrXf
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule behavioral1/files/0x000b000000012256-2.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Deletes itself 1 IoCs
pid Process 1028 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1668 zskhost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Debug\zskhost.exe f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe File opened for modification C:\Windows\Debug\zskhost.exe f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 zskhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz zskhost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1032 f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1032 wrote to memory of 1028 1032 f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe 29 PID 1032 wrote to memory of 1028 1032 f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe 29 PID 1032 wrote to memory of 1028 1032 f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe 29 PID 1032 wrote to memory of 1028 1032 f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe"C:\Users\Admin\AppData\Local\Temp\f4570a3e1ae9fb5307f321983c446d9bbef183de59726bd11be5440e6faf25f9.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F4570A~1.EXE > nul2⤵
- Deletes itself
PID:1028
-
-
C:\Windows\Debug\zskhost.exeC:\Windows\Debug\zskhost.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
161KB
MD591d5eb21d6aa598cc67dcd6e5147639e
SHA1e43735e8fdaf043319d6b72a42f1588fd5750f2f
SHA2569d5634be23ab5fdafd8160e804e829d3105d2863c483907fcba7b79477eb7573
SHA5125d8fe33f304445bd8b38d87bf50a76452f88e24a3d953e296ea9e0ac0afcd08b6c6dee54dac7a22044796be6a2479e52568dce5fcbe785632bbe84b64cd82b71