Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/10/2024, 16:00
Static task
static1
Behavioral task
behavioral1
Sample
z71htmivzKAUpOkr2J.exe
Resource
win7-20240903-en
General
-
Target
z71htmivzKAUpOkr2J.exe
-
Size
635KB
-
MD5
4cc4300ca47f721736cf09e113d5d911
-
SHA1
2c4cdbd5ecd86653e18945a320cd021001ca03f8
-
SHA256
60b3f4ef12794600833b77583624d77d037885f3bbc6361b013eb4ecf2017b99
-
SHA512
b7c715886f4bdbb02d2ce9277c96bcdb3eb0c5c84b67ea6d5b936a703ee6772c8eb9cd0f7205eeca9ccdc350c131039e1e7b3e19d7bd6df8b4166c3bf1f6af5e
-
SSDEEP
12288:nYf0+ST8QGjRBBeLICPy1CS9jPWinuHg7VCFYKK56eS95Cdr:nYpmeTBWn78TjuHghCNo6eOM
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2860 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language z71htmivzKAUpOkr2J.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2808 z71htmivzKAUpOkr2J.exe 2808 z71htmivzKAUpOkr2J.exe 2808 z71htmivzKAUpOkr2J.exe 2808 z71htmivzKAUpOkr2J.exe 2808 z71htmivzKAUpOkr2J.exe 2808 z71htmivzKAUpOkr2J.exe 2808 z71htmivzKAUpOkr2J.exe 2808 z71htmivzKAUpOkr2J.exe 2808 z71htmivzKAUpOkr2J.exe 2808 z71htmivzKAUpOkr2J.exe 2860 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2808 z71htmivzKAUpOkr2J.exe Token: SeDebugPrivilege 2860 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2808 wrote to memory of 2860 2808 z71htmivzKAUpOkr2J.exe 30 PID 2808 wrote to memory of 2860 2808 z71htmivzKAUpOkr2J.exe 30 PID 2808 wrote to memory of 2860 2808 z71htmivzKAUpOkr2J.exe 30 PID 2808 wrote to memory of 2860 2808 z71htmivzKAUpOkr2J.exe 30 PID 2808 wrote to memory of 2120 2808 z71htmivzKAUpOkr2J.exe 32 PID 2808 wrote to memory of 2120 2808 z71htmivzKAUpOkr2J.exe 32 PID 2808 wrote to memory of 2120 2808 z71htmivzKAUpOkr2J.exe 32 PID 2808 wrote to memory of 2120 2808 z71htmivzKAUpOkr2J.exe 32 PID 2808 wrote to memory of 1752 2808 z71htmivzKAUpOkr2J.exe 33 PID 2808 wrote to memory of 1752 2808 z71htmivzKAUpOkr2J.exe 33 PID 2808 wrote to memory of 1752 2808 z71htmivzKAUpOkr2J.exe 33 PID 2808 wrote to memory of 1752 2808 z71htmivzKAUpOkr2J.exe 33 PID 2808 wrote to memory of 2732 2808 z71htmivzKAUpOkr2J.exe 34 PID 2808 wrote to memory of 2732 2808 z71htmivzKAUpOkr2J.exe 34 PID 2808 wrote to memory of 2732 2808 z71htmivzKAUpOkr2J.exe 34 PID 2808 wrote to memory of 2732 2808 z71htmivzKAUpOkr2J.exe 34 PID 2808 wrote to memory of 2912 2808 z71htmivzKAUpOkr2J.exe 35 PID 2808 wrote to memory of 2912 2808 z71htmivzKAUpOkr2J.exe 35 PID 2808 wrote to memory of 2912 2808 z71htmivzKAUpOkr2J.exe 35 PID 2808 wrote to memory of 2912 2808 z71htmivzKAUpOkr2J.exe 35 PID 2808 wrote to memory of 1496 2808 z71htmivzKAUpOkr2J.exe 36 PID 2808 wrote to memory of 1496 2808 z71htmivzKAUpOkr2J.exe 36 PID 2808 wrote to memory of 1496 2808 z71htmivzKAUpOkr2J.exe 36 PID 2808 wrote to memory of 1496 2808 z71htmivzKAUpOkr2J.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\z71htmivzKAUpOkr2J.exe"C:\Users\Admin\AppData\Local\Temp\z71htmivzKAUpOkr2J.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\z71htmivzKAUpOkr2J.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\z71htmivzKAUpOkr2J.exe"C:\Users\Admin\AppData\Local\Temp\z71htmivzKAUpOkr2J.exe"2⤵PID:2120
-
-
C:\Users\Admin\AppData\Local\Temp\z71htmivzKAUpOkr2J.exe"C:\Users\Admin\AppData\Local\Temp\z71htmivzKAUpOkr2J.exe"2⤵PID:1752
-
-
C:\Users\Admin\AppData\Local\Temp\z71htmivzKAUpOkr2J.exe"C:\Users\Admin\AppData\Local\Temp\z71htmivzKAUpOkr2J.exe"2⤵PID:2732
-
-
C:\Users\Admin\AppData\Local\Temp\z71htmivzKAUpOkr2J.exe"C:\Users\Admin\AppData\Local\Temp\z71htmivzKAUpOkr2J.exe"2⤵PID:2912
-
-
C:\Users\Admin\AppData\Local\Temp\z71htmivzKAUpOkr2J.exe"C:\Users\Admin\AppData\Local\Temp\z71htmivzKAUpOkr2J.exe"2⤵PID:1496
-