Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
105s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 08:08
Static task
static1
Behavioral task
behavioral1
Sample
Zikenzie Public/_.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Zikenzie Public/_.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Zikenzie Public/zikenzie.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Zikenzie Public/zikenzie.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Zikenzie Public/zikenzies.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Zikenzie Public/zikenzies.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
Zikenzie Public/_.exe
-
Size
710KB
-
MD5
cfe310407b529981bc76be0d5f36b93f
-
SHA1
6f2ba58dd7738da12bdab220ace30b3359d139ab
-
SHA256
17bd43df6d597b8d3e0d9e682eb59c30ba2f48fca1853cac1b1f92bbb7ceb013
-
SHA512
3de0814632c375364068af0479534f4b771c8023dcb824ea16937c14c797196882bd94bc536b49ad46b30dc2b64b62279659ea4ee17ea5603d10619ce423e070
-
SSDEEP
12288:ChkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aXtns5S4PcLcKq:iRmJkcoQricOIQxiZY1iaXtnXWSlq
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4892 _.exe 4892 _.exe -
Suspicious use of FindShellTrayWindow 60 IoCs
pid Process 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe -
Suspicious use of SendNotifyMessage 60 IoCs
pid Process 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe 4892 _.exe