Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
17/11/2023, 17:15
Static task
static1
Behavioral task
behavioral1
Sample
cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790.dll
Resource
win7-20231023-en
General
-
Target
cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790.dll
-
Size
539KB
-
MD5
2169e871d4ca668d1872722d1a0695dc
-
SHA1
add2bbbac042c328ed71c9fd2efcb9cbce5a89f7
-
SHA256
cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790
-
SHA512
fdb93959e88f9cf59be9c515127d02ec41b1370544c23a82b51a49f51b611231e91549a043d7796acef4e95539c75f8a95046b2b31ea0011104a2762b2504c64
-
SSDEEP
12288:2fgs/ArUlRabXDUMr6xziFHPSMI0VI/+m3Ian:2fZY2an/JzxOD4an
Malware Config
Extracted
zloader
Apr14
Spam
http://wmwifbajxxbcxmucxmlc.com/post.php
http://ojnxjgfjlftfkkuxxiqd.com/post.php
http://pwkqhdgytsshkoibaake.com/post.php
http://snnmnkxdhflwgthqismb.com/post.php
http://iawfqecrwohcxnhwtofa.com/post.php
http://nlbmfsyplohyaicmxhum.com/post.php
http://fvqlkgedqjiqgapudkgq.com/post.php
http://cmmxhurildiigqghlryq.com/post.php
http://nmqsmbiabjdnuushksas.com/post.php
http://fyratyubvflktyyjiqgq.com/post.php
-
build_id
102
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4640 set thread context of 4872 4640 rundll32.exe 108 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 4872 msiexec.exe Token: SeSecurityPrivilege 4872 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4264 wrote to memory of 4640 4264 rundll32.exe 86 PID 4264 wrote to memory of 4640 4264 rundll32.exe 86 PID 4264 wrote to memory of 4640 4264 rundll32.exe 86 PID 4640 wrote to memory of 4872 4640 rundll32.exe 108 PID 4640 wrote to memory of 4872 4640 rundll32.exe 108 PID 4640 wrote to memory of 4872 4640 rundll32.exe 108 PID 4640 wrote to memory of 4872 4640 rundll32.exe 108 PID 4640 wrote to memory of 4872 4640 rundll32.exe 108
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cc87e6581ca91f941f65332b2de0e681d58491b54aff9d0b30afae828a5f5790.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4872
-
-