Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
63s -
max time network
65s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
24/01/2025, 18:21
Static task
static1
Behavioral task
behavioral1
Sample
42.zip
Resource
win10ltsc2021-20250113-en
General
-
Target
42.zip
-
Size
41KB
-
MD5
1df9a18b18332f153918030b7b516615
-
SHA1
6c42c62696616b72bbfc88a4be4ead57aa7bc503
-
SHA256
bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa
-
SHA512
6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80
-
SSDEEP
768:hzyVr8GSKL6O3QOXk/0u3wqOghrFCezL1VFJdbq2QTJTw02Q:hGx8DKXE//ZhhCirFi2cwK
Malware Config
Signatures
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3406519639-3774642266-3926631722-1000_Classes\Local Settings 7zFM.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4392 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeRestorePrivilege 4392 7zFM.exe Token: 35 4392 7zFM.exe Token: SeSecurityPrivilege 4392 7zFM.exe Token: SeSecurityPrivilege 4392 7zFM.exe Token: SeSecurityPrivilege 4392 7zFM.exe Token: SeSecurityPrivilege 4392 7zFM.exe Token: SeSecurityPrivilege 4392 7zFM.exe Token: SeSecurityPrivilege 4392 7zFM.exe Token: SeSecurityPrivilege 4392 7zFM.exe Token: SeSecurityPrivilege 4392 7zFM.exe Token: SeSecurityPrivilege 4392 7zFM.exe Token: SeSecurityPrivilege 4392 7zFM.exe Token: SeSecurityPrivilege 4392 7zFM.exe Token: SeSecurityPrivilege 4392 7zFM.exe Token: SeSecurityPrivilege 4392 7zFM.exe Token: SeSecurityPrivilege 4392 7zFM.exe Token: SeSecurityPrivilege 4392 7zFM.exe Token: SeSecurityPrivilege 4392 7zFM.exe -
Suspicious use of FindShellTrayWindow 17 IoCs
pid Process 4392 7zFM.exe 4392 7zFM.exe 4392 7zFM.exe 4392 7zFM.exe 4392 7zFM.exe 4392 7zFM.exe 4392 7zFM.exe 4392 7zFM.exe 4392 7zFM.exe 4392 7zFM.exe 4392 7zFM.exe 4392 7zFM.exe 4392 7zFM.exe 4392 7zFM.exe 4392 7zFM.exe 4392 7zFM.exe 4392 7zFM.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\42.zip"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4392
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3328
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD50a76bd3e26768bba68aca3d210997069
SHA1753690994a18cf58ed0fe3749d16448b763047b8
SHA2569056b87f079861d1b0f041317d6415927d9ffb6498ce2530ff90fda69fa64e78
SHA51214408ea7f44bc365a58d7480fff9ea3b10fa21bfbd3363c6e30b74a4d4121677e20ce1108cce12c203f0760768aee1c1aa69b130e090c409f9a516ea02d70c49