Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1191s
  • max time network
    853s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21/05/2024, 10:39

General

  • Target

    ziath-mohawk.2.1.297-en-release.exe

  • Size

    535.4MB

  • MD5

    418096224384dec1f270c228a09758e1

  • SHA1

    2202658231093f524f01a5f7ce656e348599dcb5

  • SHA256

    e8d675c128547fd3a9a4da2f80dd027af01c54232a9aa814301db795028de4db

  • SHA512

    ac56b7113b99ea9fc479afe435e077c5e572e2a1d3dbab826fd73867eeb24e0ff5b80cb99477c4755d0550703239b5ff011587dadba188de3d7bbcd46080aa34

  • SSDEEP

    12582912:kcX/fDlH5W+xH3KszFqMKP02D4ksXi748fZo0MCmFbkbDLLeyasJM:pfDN7qMK7sXm4yo0MCmFwbXLeyasi

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ziath-mohawk.2.1.297-en-release.exe
    "C:\Users\Admin\AppData\Local\Temp\ziath-mohawk.2.1.297-en-release.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Users\Admin\AppData\Local\Temp\is-A4BEV.tmp\ziath-mohawk.2.1.297-en-release.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-A4BEV.tmp\ziath-mohawk.2.1.297-en-release.tmp" /SL5="$50150,561107073,56832,C:\Users\Admin\AppData\Local\Temp\ziath-mohawk.2.1.297-en-release.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-0FPKI.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-0FPKI.tmp\psvince.dll

    Filesize

    36KB

    MD5

    a4e5c512b047a6d9dc38549161cac4de

    SHA1

    49d3e74f9604a6c61cda04ccc6d3cda87e280dfb

    SHA256

    c7f1e7e866834d9024f97c2b145c09d106e447e8abd65a10a1732116d178e44e

    SHA512

    2edb8a492b8369d56dda735a652c9e08539a5c4709a794efaff91adcae192a636d0545725af16cf8c31b275b34c2f19e4b019b57fb9050b99de65a4c08e3eee1

  • \Users\Admin\AppData\Local\Temp\is-A4BEV.tmp\ziath-mohawk.2.1.297-en-release.tmp

    Filesize

    690KB

    MD5

    a2c4d52c66b4b399facadb8cc8386745

    SHA1

    c326304c56a52a3e5bfbdce2fef54604a0c653e0

    SHA256

    6c0465ce64c07e729c399a338705941d77727c7d089430957df3e91a416e9d2a

    SHA512

    2a66256ff8535e2b300aa0ca27b76e85d42422b0aaf5e7e6d055f7abb9e338929c979e185c6be8918d920fb134b7f28a76b714579cacb8ace09000c046dd34d6

  • memory/2868-2-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/2868-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2868-18-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2944-13-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2944-19-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB