Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
31/07/2024, 00:53
Static task
static1
Behavioral task
behavioral1
Sample
283f2c9a8fc3bf7bb658be696981da27.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
283f2c9a8fc3bf7bb658be696981da27.exe
Resource
win10v2004-20240730-en
General
-
Target
283f2c9a8fc3bf7bb658be696981da27.exe
-
Size
559KB
-
MD5
283f2c9a8fc3bf7bb658be696981da27
-
SHA1
5ccf04ba9544a0a834975c8f2342d3e628a3806d
-
SHA256
f3a27f3d4a44f3c4615a2a3066d766f1c0281d350a20d96ef579ec8f3e24459f
-
SHA512
eea5b5a5fcb0ea0f66d6502bab35d5fc250294a029bd2d057c96614da137adff9af71e067aac6fb4680b90a3658d7ad3341c268d495379f846b30597406d819e
-
SSDEEP
12288:/ZJtAgzmWOt9BgBtCMvHk2alzDxNApin5w8qGZLUEUVB5fc6qH:BJtAguyjCeHCzDxlVZLUECfc
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2752 zsdafg.exe 2948 zsdafg.exe 2852 zsdafg.exe -
Loads dropped DLL 3 IoCs
pid Process 1476 283f2c9a8fc3bf7bb658be696981da27.exe 2752 zsdafg.exe 2752 zsdafg.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Roaming\\zsdafg.exe" 283f2c9a8fc3bf7bb658be696981da27.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2752 set thread context of 2852 2752 zsdafg.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 283f2c9a8fc3bf7bb658be696981da27.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zsdafg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zsdafg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zsdafg.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1476 283f2c9a8fc3bf7bb658be696981da27.exe 1476 283f2c9a8fc3bf7bb658be696981da27.exe 1476 283f2c9a8fc3bf7bb658be696981da27.exe 1476 283f2c9a8fc3bf7bb658be696981da27.exe 1476 283f2c9a8fc3bf7bb658be696981da27.exe 1476 283f2c9a8fc3bf7bb658be696981da27.exe 2752 zsdafg.exe 2752 zsdafg.exe 2752 zsdafg.exe 2752 zsdafg.exe 2752 zsdafg.exe 2752 zsdafg.exe 2948 zsdafg.exe 2948 zsdafg.exe 2948 zsdafg.exe 2948 zsdafg.exe 2752 zsdafg.exe 2752 zsdafg.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2852 zsdafg.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1476 283f2c9a8fc3bf7bb658be696981da27.exe Token: SeDebugPrivilege 2752 zsdafg.exe Token: SeDebugPrivilege 2948 zsdafg.exe Token: SeDebugPrivilege 2852 zsdafg.exe Token: 33 2852 zsdafg.exe Token: SeIncBasePriorityPrivilege 2852 zsdafg.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2852 zsdafg.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1476 wrote to memory of 2752 1476 283f2c9a8fc3bf7bb658be696981da27.exe 30 PID 1476 wrote to memory of 2752 1476 283f2c9a8fc3bf7bb658be696981da27.exe 30 PID 1476 wrote to memory of 2752 1476 283f2c9a8fc3bf7bb658be696981da27.exe 30 PID 1476 wrote to memory of 2752 1476 283f2c9a8fc3bf7bb658be696981da27.exe 30 PID 2752 wrote to memory of 2948 2752 zsdafg.exe 31 PID 2752 wrote to memory of 2948 2752 zsdafg.exe 31 PID 2752 wrote to memory of 2948 2752 zsdafg.exe 31 PID 2752 wrote to memory of 2948 2752 zsdafg.exe 31 PID 2752 wrote to memory of 2852 2752 zsdafg.exe 32 PID 2752 wrote to memory of 2852 2752 zsdafg.exe 32 PID 2752 wrote to memory of 2852 2752 zsdafg.exe 32 PID 2752 wrote to memory of 2852 2752 zsdafg.exe 32 PID 2752 wrote to memory of 2852 2752 zsdafg.exe 32 PID 2752 wrote to memory of 2852 2752 zsdafg.exe 32 PID 2752 wrote to memory of 2852 2752 zsdafg.exe 32 PID 2752 wrote to memory of 2852 2752 zsdafg.exe 32 PID 2752 wrote to memory of 2852 2752 zsdafg.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\283f2c9a8fc3bf7bb658be696981da27.exe"C:\Users\Admin\AppData\Local\Temp\283f2c9a8fc3bf7bb658be696981da27.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Roaming\zsdafg.exe"C:\Users\Admin\AppData\Roaming\zsdafg.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Roaming\zsdafg.exe"C:\Users\Admin\AppData\Roaming\zsdafg.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2948
-
-
C:\Users\Admin\AppData\Roaming\zsdafg.exe"C:\Users\Admin\AppData\Roaming\zsdafg.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2852
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
559KB
MD5283f2c9a8fc3bf7bb658be696981da27
SHA15ccf04ba9544a0a834975c8f2342d3e628a3806d
SHA256f3a27f3d4a44f3c4615a2a3066d766f1c0281d350a20d96ef579ec8f3e24459f
SHA512eea5b5a5fcb0ea0f66d6502bab35d5fc250294a029bd2d057c96614da137adff9af71e067aac6fb4680b90a3658d7ad3341c268d495379f846b30597406d819e