Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
5zapret-win...64.cmd
windows7-x64
1zapret-win...64.cmd
windows10-2004-x64
1zapret-win...et.exe
windows7-x64
zapret-win...et.exe
windows10-2004-x64
zapret-win...ig.exe
windows7-x64
zapret-win...ig.exe
windows10-2004-x64
zapret-win...ck.cmd
windows7-x64
5zapret-win...ck.cmd
windows10-2004-x64
7zapret-win...eck.sh
ubuntu-18.04-amd64
6zapret-win...eck.sh
debian-9-armhf
6zapret-win...eck.sh
debian-9-mips
6zapret-win...eck.sh
debian-9-mipsel
6zapret-win...log.sh
ubuntu-18.04-amd64
3zapret-win...log.sh
debian-9-armhf
3zapret-win...log.sh
debian-9-mips
3zapret-win...log.sh
debian-9-mipsel
3zapret-win...ase.sh
windows7-x64
3zapret-win...ase.sh
windows10-2004-x64
3zapret-win...log.sh
windows7-x64
3zapret-win...log.sh
windows10-2004-x64
3zapret-win...ate.sh
windows7-x64
3zapret-win...ate.sh
windows10-2004-x64
3zapret-win...ype.sh
windows7-x64
3zapret-win...ype.sh
windows10-2004-x64
3zapret-win...irt.sh
windows7-x64
3zapret-win...irt.sh
windows10-2004-x64
3zapret-win...et.exe
windows7-x64
1zapret-win...et.exe
windows10-2004-x64
1zapret-win...ig.exe
windows7-x64
1zapret-win...ig.exe
windows10-2004-x64
1zapret-win...rt.dll
windows7-x64
1zapret-win...rt.dll
windows10-2004-x64
1Analysis
-
max time kernel
0s -
max time network
129s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
18/10/2024, 02:13
Behavioral task
behavioral1
Sample
zapret-win-bundle-master/arm64/install_arm64.cmd
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
zapret-win-bundle-master/arm64/install_arm64.cmd
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
zapret-win-bundle-master/arm64/ip2net.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
zapret-win-bundle-master/arm64/ip2net.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
zapret-win-bundle-master/arm64/mdig.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
zapret-win-bundle-master/arm64/mdig.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
zapret-win-bundle-master/blockcheck/blockcheck.cmd
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
zapret-win-bundle-master/blockcheck/blockcheck.cmd
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
Behavioral task
behavioral10
Sample
zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral11
Sample
zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral12
Sample
zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
Behavioral task
behavioral13
Sample
zapret-win-bundle-master/blockcheck/zapret/blog.sh
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
Behavioral task
behavioral14
Sample
zapret-win-bundle-master/blockcheck/zapret/blog.sh
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral15
Sample
zapret-win-bundle-master/blockcheck/zapret/blog.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral16
Sample
zapret-win-bundle-master/blockcheck/zapret/blog.sh
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral17
Sample
zapret-win-bundle-master/blockcheck/zapret/common/base.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
zapret-win-bundle-master/blockcheck/zapret/common/base.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
zapret-win-bundle-master/blockcheck/zapret/common/dialog.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
zapret-win-bundle-master/blockcheck/zapret/common/dialog.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
zapret-win-bundle-master/blockcheck/zapret/common/elevate.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
zapret-win-bundle-master/blockcheck/zapret/common/elevate.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
zapret-win-bundle-master/blockcheck/zapret/common/fwtype.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
zapret-win-bundle-master/blockcheck/zapret/common/fwtype.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
zapret-win-bundle-master/blockcheck/zapret/common/virt.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
zapret-win-bundle-master/blockcheck/zapret/common/virt.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
zapret-win-bundle-master/blockcheck/zapret/ip2net/ip2net.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
zapret-win-bundle-master/blockcheck/zapret/ip2net/ip2net.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
zapret-win-bundle-master/blockcheck/zapret/mdig/mdig.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
zapret-win-bundle-master/blockcheck/zapret/mdig/mdig.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
zapret-win-bundle-master/blockcheck/zapret/nfq/WinDivert.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral32
Sample
zapret-win-bundle-master/blockcheck/zapret/nfq/WinDivert.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh
-
Size
45KB
-
MD5
aea6d68ecc576aa7088623c776090b1d
-
SHA1
e1f288c7b975c182c1436ecaa21eba995f853f70
-
SHA256
5d2992503cd28c1b1f4b55a59f3eacb38ff0c4ce68599008afa0c3d8c9afc38c
-
SHA512
1ee2452704ca17b61419dc73595ab7a18dbbe5e85cfbbe8e4e032850244bb2ab739979fab521ad38372f86c60661cef48a04d6c8cf5bead057605ba026c56b03
-
SSDEEP
768:IeQ3DX3LTqs3ln5bhs/8Uxg8OOwcG0NscyKjTDG3NJrc/AG/fofrtwWLlQLyxXiL:dQ3DX3LT75peBNsXdPfrtwWLlQLyxXiL
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 2 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep -
description ioc Process File opened for reading /proc/137/cmdline pgrep File opened for reading /proc/427/cmdline pgrep File opened for reading /proc/502/cmdline pgrep File opened for reading /proc/81/status pgrep File opened for reading /proc/964/status pgrep File opened for reading /proc/1192/status pgrep File opened for reading /proc/8/status pgrep File opened for reading /proc/617/status pgrep File opened for reading /proc/1358/status pgrep File opened for reading /proc/1515/status pgrep File opened for reading /proc/8/status pgrep File opened for reading /proc/617/cmdline pgrep File opened for reading /proc/32/status pgrep File opened for reading /proc/1083/status pgrep File opened for reading /proc/1017/cmdline pgrep File opened for reading /proc/1120/cmdline pgrep File opened for reading /proc/497/cmdline pgrep File opened for reading /proc/1128/status pgrep File opened for reading /proc/21/cmdline pgrep File opened for reading /proc/955/cmdline pgrep File opened for reading /proc/7/cmdline pgrep File opened for reading /proc/89/cmdline pgrep File opened for reading /proc/filesystems sed File opened for reading /proc/14/status pgrep File opened for reading /proc/31/cmdline pgrep File opened for reading /proc/22/cmdline pgrep File opened for reading /proc/1165/status pgrep File opened for reading /proc/1184/status pgrep File opened for reading /proc/715/status pgrep File opened for reading /proc/964/cmdline pgrep File opened for reading /proc/531/status pgrep File opened for reading /proc/556/status pgrep File opened for reading /proc/1187/cmdline pgrep File opened for reading /proc/1162/cmdline pgrep File opened for reading /proc/168/status pgrep File opened for reading /proc/170/status pgrep File opened for reading /proc/212/cmdline pgrep File opened for reading /proc/1059/status pgrep File opened for reading /proc/1079/cmdline pgrep File opened for reading /proc/1162/status pgrep File opened for reading /proc/1513/status pgrep File opened for reading /proc/16/status pgrep File opened for reading /proc/23/cmdline pgrep File opened for reading /proc/174/cmdline pgrep File opened for reading /proc/568/status pgrep File opened for reading /proc/1017/status pgrep File opened for reading /proc/1515/status pgrep File opened for reading /proc/84/status pgrep File opened for reading /proc/177/cmdline pgrep File opened for reading /proc/263/status pgrep File opened for reading /proc/263/cmdline pgrep File opened for reading /proc/743/status pgrep File opened for reading /proc/568/status pgrep File opened for reading /proc/993/status pgrep File opened for reading /proc/1042/cmdline pgrep File opened for reading /proc/26/status pgrep File opened for reading /proc/81/cmdline pgrep File opened for reading /proc/181/status pgrep File opened for reading /proc/550/status pgrep File opened for reading /proc/17/status pgrep File opened for reading /proc/423/cmdline pgrep File opened for reading /proc/24/status pgrep File opened for reading /proc/36/status pgrep File opened for reading /proc/1162/status pgrep
Processes
-
/tmp/zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh/tmp/zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh1⤵PID:1517
-
/usr/bin/dirnamedirname /tmp/zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh2⤵PID:1518
-
-
/bin/sleepsleep 0.0012⤵PID:1520
-
-
/bin/grepgrep -Fxq /usr/sbin2⤵PID:1522
-
-
/bin/grepgrep -Fxq /sbin2⤵PID:1524
-
-
/bin/unameuname2⤵PID:1525
-
-
/usr/bin/headhead -n 12⤵PID:1528
-
-
/bin/sedsed "s/\\x0/\\n/g" /proc/1/cmdline2⤵PID:1527
-
-
/bin/readlinkreadlink /sbin/init2⤵PID:1529
-
-
/usr/bin/basenamebasename /lib/systemd/systemd2⤵PID:1530
-
-
/bin/sedsed -nre "s/^Linux version ([0-9]+)\\.[0-9]+.*\$/\\1/p" /proc/version2⤵PID:1531
-
-
/bin/sedsed -nre "s/^Linux version [0-9]+\\.([0-9]+).*\$/\\1/p" /proc/version2⤵
- Reads runtime system information
PID:1532
-
-
/usr/bin/pgreppgrep "^nfqws\$"2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1533
-
-
/usr/bin/pgreppgrep "^tpws\$"2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1534
-
-
/usr/bin/idid -u2⤵PID:1535
-