Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
5zapret-dis...rt.dll
windows7-x64
1zapret-dis...rt.dll
windows10-2004-x64
1zapret-dis...64.sys
windows10-2004-x64
1zapret-dis...n1.dll
windows7-x64
5zapret-dis...n1.dll
windows10-2004-x64
5zapret-dis...rd.bat
windows7-x64
5zapret-dis...rd.bat
windows10-2004-x64
5zapret-dis...be.bat
windows7-x64
5zapret-dis...be.bat
windows10-2004-x64
5zapret-dis...rd.bat
windows7-x64
8zapret-dis...rd.bat
windows10-2004-x64
8zapret-dis...be.bat
windows7-x64
8zapret-dis...be.bat
windows10-2004-x64
8zapret-dis...ve.bat
windows7-x64
8zapret-dis...ve.bat
windows10-2004-x64
8zapret-dis...ws.exe
windows7-x64
5zapret-dis...ws.exe
windows10-2004-x64
5Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 15:05
Behavioral task
behavioral1
Sample
zapret-discord-youtube-main/WinDivert.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
zapret-discord-youtube-main/WinDivert.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
zapret-discord-youtube-main/WinDivert64.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
zapret-discord-youtube-main/cygwin1.dll
Resource
win7-20240903-en
Behavioral task
behavioral5
Sample
zapret-discord-youtube-main/cygwin1.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
zapret-discord-youtube-main/discord.bat
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
zapret-discord-youtube-main/discord.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
zapret-discord-youtube-main/discord_youtube.bat
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
zapret-discord-youtube-main/discord_youtube.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
zapret-discord-youtube-main/service_discord.bat
Resource
win7-20240903-en
Behavioral task
behavioral11
Sample
zapret-discord-youtube-main/service_discord.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
zapret-discord-youtube-main/service_discord_youtube.bat
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
zapret-discord-youtube-main/service_discord_youtube.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
zapret-discord-youtube-main/service_remove.bat
Resource
win7-20240903-en
Behavioral task
behavioral15
Sample
zapret-discord-youtube-main/service_remove.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
zapret-discord-youtube-main/winws.exe
Resource
win7-20240903-en
Behavioral task
behavioral17
Sample
zapret-discord-youtube-main/winws.exe
Resource
win10v2004-20241007-en
General
-
Target
zapret-discord-youtube-main/cygwin1.dll
-
Size
998KB
-
MD5
c50b50303fae4afe7248307339a00d13
-
SHA1
1b4a3f7666172809bd0d88f793ee855bd4b92938
-
SHA256
712c39a069541afa69cfcbe01b422bd67b4201eee7e94cc1327d4ed8b4fa2167
-
SHA512
123d06a0a5f891851e372881860b9d7fb8c453dcdbbca5970b9b2bf205f08f0a724595c6892f4afbbb4f85292a886dddffbf0d36dfe18d4b6eea7a5d12451762
-
SSDEEP
24576:YbYJZPZf7KMuiA7Q4lsXBmStxacrFhG+wTGiPoy1u7MHltI:YAZfmM/A7Uk6xhpmGkoy1u7MH0
Malware Config
Signatures
-
resource yara_rule behavioral4/memory/2788-0-0x000007FEF6150000-0x000007FEF6462000-memory.dmp upx behavioral4/memory/2788-2-0x000007FEF5E30000-0x000007FEF6142000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2788 rundll32.exe Token: SeBackupPrivilege 2788 rundll32.exe Token: SeDebugPrivilege 2788 rundll32.exe