Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

23/01/2024, 11:22

240123-ng2j1ahgel 10

26/06/2020, 17:36

200626-xs19z3xc5a 10

Analysis

  • max time kernel
    150s
  • max time network
    105s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    26/06/2020, 17:36

General

  • Target

    SecuriteInfo.com.BScope.TrojanSpy.Ursnif.27559.dll

  • Size

    426KB

  • MD5

    95d3b622d696c1a31dbef624a2e47163

  • SHA1

    8a1c5a4f794af421e7b54471ed7f4a62212721a0

  • SHA256

    f84e08a4d83f63cb37f7117f401c242ecbd3ebbd6b7a12fb99332bcf5950f803

  • SHA512

    c3ac8a246e7d769faa21f330c5c0a0fef4c4e33a6875478e43ee891f367e90fee3ea657b08ba338f6263e38b17efe69b7c5c1c86167afc871b9a20f251fd67d1

Malware Config

Signatures

  • Discovers systems in the same network 1 TTPs 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of WriteProcessMemory 35 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Blacklisted process makes network request 18 IoCs
  • Runs net.exe
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.TrojanSpy.Ursnif.27559.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3136
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.TrojanSpy.Ursnif.27559.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetThreadContext
      PID:516
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        • Suspicious use of AdjustPrivilegeToken
        • Blacklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        PID:2828
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c ipconfig /all
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3852
          • C:\Windows\SysWOW64\ipconfig.exe
            ipconfig /all
            5⤵
              PID:2184
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c net config workstation
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2988
            • C:\Windows\SysWOW64\net.exe
              net config workstation
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3340
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 config workstation
                6⤵
                  PID:2812
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c net view /all
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1344
              • C:\Windows\SysWOW64\net.exe
                net view /all
                5⤵
                • Discovers systems in the same network
                PID:2300
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c net view /all /domain
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1480
              • C:\Windows\SysWOW64\net.exe
                net view /all /domain
                5⤵
                • Discovers systems in the same network
                PID:3540

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2828-1-0x0000000000610000-0x000000000063B000-memory.dmp

        Filesize

        172KB