Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
97229fd051d6380704ac2abcbe438b8a.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
97229fd051d6380704ac2abcbe438b8a.dll
Resource
win10v2004-20231215-en
General
-
Target
97229fd051d6380704ac2abcbe438b8a.dll
-
Size
52KB
-
MD5
97229fd051d6380704ac2abcbe438b8a
-
SHA1
3ea244080cae190587348483f015371fc65bce0f
-
SHA256
57f3186ba5a3a986f9e135daff6d77514e7f88e991fb0a8624f7d7c5b59306e7
-
SHA512
55ef474fd2991772b796a79fe4b4521705f338f95343f77f8d286061850bdac1836285314a7f3c1d4d850bc99d80780c830efb65fd39c9317702a8f0034cc3d7
-
SSDEEP
768:Av000btDotnY8gVhCT1IqtyP29k56955RsMYavvFDw0nIX0WcOUYZY:m9yxDhCT1xtq29k56P5RHjDw0npWeY+
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 7 3852 rundll32.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\Zalam.sys rundll32.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Zalam\ImagePath = "system32\\DRIVERS\\Zalam.sys" rundll32.exe -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 202.96.96.68 -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 3852 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 3852 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3788 wrote to memory of 3852 3788 rundll32.exe 84 PID 3788 wrote to memory of 3852 3788 rundll32.exe 84 PID 3788 wrote to memory of 3852 3788 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\97229fd051d6380704ac2abcbe438b8a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\97229fd051d6380704ac2abcbe438b8a.dll,#12⤵
- Blocklisted process makes network request
- Drops file in Drivers directory
- Sets service image path in registry
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:3852
-