Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
9Static
static
9zonesszanp...��.exe
windows7-x64
8zonesszanp...��.exe
windows10-2004-x64
8zonesszanp...EL.dll
windows7-x64
8zonesszanp...EL.dll
windows10-2004-x64
8zonesszanp...��.url
windows7-x64
1zonesszanp...��.url
windows10-2004-x64
1zonesszanp...��.url
windows7-x64
1zonesszanp...��.url
windows10-2004-x64
1Analysis
-
max time kernel
91s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2022, 19:12
Behavioral task
behavioral1
Sample
zonesszanpinglun-v1.0/QQ空间秒赞秒评论(秒赞贴吧).exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
zonesszanpinglun-v1.0/QQ空间秒赞秒评论(秒赞贴吧).exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
zonesszanpinglun-v1.0/SkinH_EL.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
zonesszanpinglun-v1.0/SkinH_EL.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
zonesszanpinglun-v1.0/去脚本之家看看.url
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
zonesszanpinglun-v1.0/去脚本之家看看.url
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
zonesszanpinglun-v1.0/服务器软件.url
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
zonesszanpinglun-v1.0/服务器软件.url
Resource
win10v2004-20220812-en
General
-
Target
zonesszanpinglun-v1.0/SkinH_EL.dll
-
Size
86KB
-
MD5
147127382e001f495d1842ee7a9e7912
-
SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b
-
SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc
-
SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d
-
SSDEEP
1536:s5Np2dgZgIehUUS3E1Ujmrvl179D53UWnGQRJZiXRmrCnKptnouy8K:s5Np2dlUX0+Cx17F8QRJZKmOK3outK
Malware Config
Signatures
-
resource yara_rule behavioral4/memory/3516-133-0x0000000010000000-0x000000001003D000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2952 3516 WerFault.exe 79 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3516 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3712 wrote to memory of 3516 3712 rundll32.exe 79 PID 3712 wrote to memory of 3516 3712 rundll32.exe 79 PID 3712 wrote to memory of 3516 3712 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\zonesszanpinglun-v1.0\SkinH_EL.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\zonesszanpinglun-v1.0\SkinH_EL.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:3516 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 6443⤵
- Program crash
PID:2952
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3516 -ip 35161⤵PID:3504