Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 21:21
Static task
static1
Behavioral task
behavioral1
Sample
d6bf20a5e07be2c1a234b034f25b1bebf7774437915c1678442082a63ee8ee5d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
d6bf20a5e07be2c1a234b034f25b1bebf7774437915c1678442082a63ee8ee5d.exe
Resource
win10v2004-20240412-en
General
-
Target
d6bf20a5e07be2c1a234b034f25b1bebf7774437915c1678442082a63ee8ee5d.exe
-
Size
142KB
-
MD5
49dcbe6791db32b29b9b407d5a56519a
-
SHA1
e518601ced073245a436dc4544421bae6ff45182
-
SHA256
d6bf20a5e07be2c1a234b034f25b1bebf7774437915c1678442082a63ee8ee5d
-
SHA512
f337766c247e95d3be9d351871a24c82d279c4cd266576d05903f9c770a214d612f80d8456069cc57dff2b45a1511dcadcfad1ce305e029a8fa43a391e303f36
-
SSDEEP
3072:5gjzzvzm/Z7Uy1tVkBiyyUzGBk9VeFS43tqPJpPseX:Ka/ZT/UKBk749CpX
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 952 lmzjuzl.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\Mozilla\lmzjuzl.exe d6bf20a5e07be2c1a234b034f25b1bebf7774437915c1678442082a63ee8ee5d.exe File created C:\PROGRA~3\Mozilla\yxbjhae.dll lmzjuzl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6bf20a5e07be2c1a234b034f25b1bebf7774437915c1678442082a63ee8ee5d.exe"C:\Users\Admin\AppData\Local\Temp\d6bf20a5e07be2c1a234b034f25b1bebf7774437915c1678442082a63ee8ee5d.exe"1⤵
- Drops file in Program Files directory
PID:1504
-
C:\PROGRA~3\Mozilla\lmzjuzl.exeC:\PROGRA~3\Mozilla\lmzjuzl.exe -qqbypme1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
142KB
MD559b8bf0957d2ae34161aba131b6794f7
SHA1cd22b36af9817a6d94f5d184473432ccce07ef7b
SHA25650c3a1137588791a36435f55f8195033142049f2c90870af85ab9e0ef707558e
SHA5122893238db79d958919867f6c908d95f9290477084efd8e4faed28a2cc844316cd76d1b88ab3ebf7ab15cd9f27e5bf763ce29348974886aab4595a993927d25ca