Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

tze6.dll

windows7_x64

1

tze6.dll

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    08/07/2020, 07:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tze6.dll

  • Size

    226KB

  • MD5

    62388b78d8d816541a34fde46c87f14c

  • SHA1

    ce64205ccda14e8f26e2c030418afce5542a1a88

  • SHA256

    dc0df8f5ee0e898e069643a84cbc8154d6191f081665e245f1a9e2085028062f

  • SHA512

    5bdeefd54b3b7dc472717b597563e72742c60182d48d347798ff4fdd5609eba83082cf0ac239ff4527096bf027fc1202adb19f91cd0cecd4681ab460be2b9fd7

Score
10/10
bankertrojangozi_ifsb

Malware Config

Signatures

  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 56 IoCs
    adwarespyware
  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb
  • Checks whether UAC is enabled 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\tze6.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2904
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\tze6.dll,#1
      2⤵
        PID:2164
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      PID:3572
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3572 CREDAT:82945 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Checks whether UAC is enabled
        • Suspicious use of SetWindowsHookEx
        PID:3924
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      PID:3004
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:82945 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Checks whether UAC is enabled
        • Suspicious use of SetWindowsHookEx
        PID:800
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      PID:1280
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1280 CREDAT:82945 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Checks whether UAC is enabled
        • Suspicious use of SetWindowsHookEx
        PID:2752

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads