Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/04/2024, 21:07

General

  • Target

    6af2acfc2952e9bc4b40eb1f3bf2bf3dc6425f3971a2720cbd6bdc4b13c25bbf.exe

  • Size

    198KB

  • MD5

    2fe5f92cd346808e1f27b69def18bca6

  • SHA1

    e86f7ebfbb2cf79f8373bd64b8e1efbe269456bc

  • SHA256

    6af2acfc2952e9bc4b40eb1f3bf2bf3dc6425f3971a2720cbd6bdc4b13c25bbf

  • SHA512

    4912e3e296dba239bcf54088f9d79875d6c9216f5e3f689fe2e0904459d5cd8dafccb544b1b499fb700b204626aaaf7f79d7c653d15f6089ef757af4e7f0c33c

  • SSDEEP

    6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOW:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXX7

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6af2acfc2952e9bc4b40eb1f3bf2bf3dc6425f3971a2720cbd6bdc4b13c25bbf.exe
    "C:\Users\Admin\AppData\Local\Temp\6af2acfc2952e9bc4b40eb1f3bf2bf3dc6425f3971a2720cbd6bdc4b13c25bbf.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6AF2AC~1.EXE > nul
      2⤵
      • Deletes itself
      PID:2552
  • C:\Windows\Debug\zskhost.exe
    C:\Windows\Debug\zskhost.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    PID:2356

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\debug\zskhost.exe

    Filesize

    198KB

    MD5

    1a0916ef1ccbc46cb10811f89146e4b3

    SHA1

    00dae7945df559bf3698fc74abfa324f36d10cc9

    SHA256

    12263b3b034afbf25ac6c716ac293ab3f52ba3ac594c0459180ea29355e56732

    SHA512

    c4cf9f313b82ca7f5f8bd00711591e36e700b4cf204fe4bb297276d049253841a3c732de192529915177daa3c90210c8e1111c48e17318e0e94e7c5f745392ec