Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
09/03/2022, 02:43
Static task
static1
Behavioral task
behavioral1
Sample
14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8.dll
Resource
win7-20220223-en
General
-
Target
14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8.dll
-
Size
370KB
-
MD5
243104faac6863b5b4a4263f4040f021
-
SHA1
597fbf324045926a5e3cc1617dc89f83ddd49792
-
SHA256
14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8
-
SHA512
3a0bf5a2731155559faf5167e00662fa69e18f81dfc671ac3132eec84ae0b4293429fda477f8bbb5d8576d64e6d36eac09e00a69c124ae99dc30f37e7868d985
Malware Config
Extracted
zloader
nut
30/11
https://aogmphregion.org.za/construction.php
https://aayanent.com/backups.php
https://eagle-family.co.uk/panel.php
https://khanbuilders.uk/wp-punch.php
https://construbienesjg.com/wp-punch.php
https://despautyajobssooka.ml/wp-smarts.php
-
build_id
257
Signatures
-
suricata: ET MALWARE Zbot POST Request to C2
suricata: ET MALWARE Zbot POST Request to C2
-
Blocklisted process makes network request 14 IoCs
flow pid Process 37 912 msiexec.exe 38 912 msiexec.exe 39 912 msiexec.exe 40 912 msiexec.exe 41 912 msiexec.exe 42 912 msiexec.exe 53 912 msiexec.exe 57 912 msiexec.exe 58 912 msiexec.exe 59 912 msiexec.exe 63 912 msiexec.exe 64 912 msiexec.exe 66 912 msiexec.exe 69 912 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1528 set thread context of 912 1528 regsvr32.exe 91 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 912 msiexec.exe Token: SeSecurityPrivilege 912 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1396 wrote to memory of 1528 1396 regsvr32.exe 79 PID 1396 wrote to memory of 1528 1396 regsvr32.exe 79 PID 1396 wrote to memory of 1528 1396 regsvr32.exe 79 PID 1528 wrote to memory of 912 1528 regsvr32.exe 91 PID 1528 wrote to memory of 912 1528 regsvr32.exe 91 PID 1528 wrote to memory of 912 1528 regsvr32.exe 91 PID 1528 wrote to memory of 912 1528 regsvr32.exe 91 PID 1528 wrote to memory of 912 1528 regsvr32.exe 91
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\14c47cc16c55060409202302048d8b8f97c9b3fa462d7710ab91bb3f3f7a75e8.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:912
-
-