Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

23/01/2024, 11:22

240123-ng2j1ahgel 10

26/06/2020, 17:36

200626-xs19z3xc5a 10

Analysis

  • max time kernel
    151s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    26/06/2020, 17:36

General

  • Target

    SecuriteInfo.com.BScope.TrojanSpy.Ursnif.27559.dll

  • Size

    426KB

  • MD5

    95d3b622d696c1a31dbef624a2e47163

  • SHA1

    8a1c5a4f794af421e7b54471ed7f4a62212721a0

  • SHA256

    f84e08a4d83f63cb37f7117f401c242ecbd3ebbd6b7a12fb99332bcf5950f803

  • SHA512

    c3ac8a246e7d769faa21f330c5c0a0fef4c4e33a6875478e43ee891f367e90fee3ea657b08ba338f6263e38b17efe69b7c5c1c86167afc871b9a20f251fd67d1

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 52 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Modifies service 2 TTPs 2 IoCs
  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Blacklisted process makes network request 17 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Discovers systems in the same network 1 TTPs 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.TrojanSpy.Ursnif.27559.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.TrojanSpy.Ursnif.27559.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetThreadContext
      PID:1484
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        • Suspicious use of AdjustPrivilegeToken
        • Blacklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        PID:1404
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c ipconfig /all
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1984
          • C:\Windows\SysWOW64\ipconfig.exe
            ipconfig /all
            5⤵
            • Modifies service
            PID:1936
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c net config workstation
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2016
          • C:\Windows\SysWOW64\net.exe
            net config workstation
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1988
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 config workstation
              6⤵
                PID:1188
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c net view /all
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1332
            • C:\Windows\SysWOW64\net.exe
              net view /all
              5⤵
              • Discovers systems in the same network
              PID:1260
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c net view /all /domain
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:368
            • C:\Windows\SysWOW64\net.exe
              net view /all /domain
              5⤵
              • Discovers systems in the same network
              PID:756

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1404-3-0x0000000000090000-0x00000000000BB000-memory.dmp

      Filesize

      172KB

    • memory/1404-2-0x00000000000C0000-0x00000000000C1000-memory.dmp

      Filesize

      4KB

    • memory/1404-1-0x0000000000090000-0x00000000000BB000-memory.dmp

      Filesize

      172KB