Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
984s -
max time network
984s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system -
submitted
08/12/2023, 09:55
Static task
static1
Behavioral task
behavioral1
Sample
be3d1522f968ad7cc46a996a64b5e5be8044075f6bd1784046e46671bf416b45.dll
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
be3d1522f968ad7cc46a996a64b5e5be8044075f6bd1784046e46671bf416b45.dll
Resource
win10v2004-20231130-en
General
-
Target
be3d1522f968ad7cc46a996a64b5e5be8044075f6bd1784046e46671bf416b45.dll
-
Size
472KB
-
MD5
f500b424c560f00ccd993a46e4b9fcfa
-
SHA1
d1da2bb6a020462d5d7ac6301395e10d2acb6b17
-
SHA256
be3d1522f968ad7cc46a996a64b5e5be8044075f6bd1784046e46671bf416b45
-
SHA512
65018b4c441db4b618a988cb6d9fa46bcfd2754af244e9d1d309295ba1d2477dd1ea6609214bc7d725b3576b4232c81fa260873357652b89529f0dabd6fd14d0
-
SSDEEP
12288:zayK7dYtaR2FV9DAuuasxaunyIVTyMAzj:zxPta+jmnlVTIzj
Malware Config
Extracted
zloader
April24misha
April24misha
http://wmwifbajxxbcxmucxmlc.com/post.php
http://onfovdaqqrwbvdfoqnof.com/post.php
http://cmmxhurildiigqghlryq.com/post.php
http://nmqsmbiabjdnuushksas.com/post.php
http://fvqlkgedqjiqgapudkgq.com/post.php
http://iawfqecrwohcxnhwtofa.com/post.php
http://nlbmfsyplohyaicmxhum.com/post.php
http://snnmnkxdhflwgthqismb.com/post.php
-
build_id
122
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1744 set thread context of 2560 1744 rundll32.exe 31 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 2560 msiexec.exe Token: SeSecurityPrivilege 2560 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2216 wrote to memory of 1744 2216 rundll32.exe 28 PID 2216 wrote to memory of 1744 2216 rundll32.exe 28 PID 2216 wrote to memory of 1744 2216 rundll32.exe 28 PID 2216 wrote to memory of 1744 2216 rundll32.exe 28 PID 2216 wrote to memory of 1744 2216 rundll32.exe 28 PID 2216 wrote to memory of 1744 2216 rundll32.exe 28 PID 2216 wrote to memory of 1744 2216 rundll32.exe 28 PID 1744 wrote to memory of 2560 1744 rundll32.exe 31 PID 1744 wrote to memory of 2560 1744 rundll32.exe 31 PID 1744 wrote to memory of 2560 1744 rundll32.exe 31 PID 1744 wrote to memory of 2560 1744 rundll32.exe 31 PID 1744 wrote to memory of 2560 1744 rundll32.exe 31 PID 1744 wrote to memory of 2560 1744 rundll32.exe 31 PID 1744 wrote to memory of 2560 1744 rundll32.exe 31 PID 1744 wrote to memory of 2560 1744 rundll32.exe 31 PID 1744 wrote to memory of 2560 1744 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\be3d1522f968ad7cc46a996a64b5e5be8044075f6bd1784046e46671bf416b45.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\be3d1522f968ad7cc46a996a64b5e5be8044075f6bd1784046e46671bf416b45.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
-