Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01/02/2022, 08:12
Static task
static1
Behavioral task
behavioral1
Sample
15e6a048813e1fa7e06751b3cccd6125d7b8efb3ed160931213ac44eafa60807.dll
Resource
win7-en-20211208
General
-
Target
15e6a048813e1fa7e06751b3cccd6125d7b8efb3ed160931213ac44eafa60807.dll
-
Size
529KB
-
MD5
96ede22c743f990a839949fb3edd381b
-
SHA1
2506fb0f8e03108b5e4ee4555e6d9f309f4f8936
-
SHA256
15e6a048813e1fa7e06751b3cccd6125d7b8efb3ed160931213ac44eafa60807
-
SHA512
14922ce98535243e4f6e5c771c02397027b75b3e73ae807335dbcb97b653fc517010d89565ca6e0399a5012d40774455318a120ae5eb3f84693f9f0da1c1ed11
Malware Config
Extracted
zloader
PLSPAM
PLSPAM
http://marchadvertisingnetwork4.com/post.php
http://marchadvertisingnetwork5.com/post.php
http://marchadvertisingnetwork6.com/post.php
http://marchadvertisingnetwork7.com/post.php
http://marchadvertisingnetwork8.com/post.php
http://marchadvertisingnetwork9.com/post.php
http://marchadvertisingnetwork10.com/post.php
-
build_id
27
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Deirbey = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Uwost\\syco.dll,DllRegisterServer" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1656 set thread context of 288 1656 rundll32.exe 30 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 288 msiexec.exe Token: SeSecurityPrivilege 288 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 480 wrote to memory of 1656 480 rundll32.exe 27 PID 480 wrote to memory of 1656 480 rundll32.exe 27 PID 480 wrote to memory of 1656 480 rundll32.exe 27 PID 480 wrote to memory of 1656 480 rundll32.exe 27 PID 480 wrote to memory of 1656 480 rundll32.exe 27 PID 480 wrote to memory of 1656 480 rundll32.exe 27 PID 480 wrote to memory of 1656 480 rundll32.exe 27 PID 1656 wrote to memory of 288 1656 rundll32.exe 30 PID 1656 wrote to memory of 288 1656 rundll32.exe 30 PID 1656 wrote to memory of 288 1656 rundll32.exe 30 PID 1656 wrote to memory of 288 1656 rundll32.exe 30 PID 1656 wrote to memory of 288 1656 rundll32.exe 30 PID 1656 wrote to memory of 288 1656 rundll32.exe 30 PID 1656 wrote to memory of 288 1656 rundll32.exe 30 PID 1656 wrote to memory of 288 1656 rundll32.exe 30 PID 1656 wrote to memory of 288 1656 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\15e6a048813e1fa7e06751b3cccd6125d7b8efb3ed160931213ac44eafa60807.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\15e6a048813e1fa7e06751b3cccd6125d7b8efb3ed160931213ac44eafa60807.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:288
-
-