Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
129s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
30/01/2022, 15:52
Static task
static1
Behavioral task
behavioral1
Sample
277c5272ac242f4f737cae075fe33b5793364090c55d9cf743e61e52a453daf6.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
277c5272ac242f4f737cae075fe33b5793364090c55d9cf743e61e52a453daf6.dll
Resource
win10-en-20211208
General
-
Target
277c5272ac242f4f737cae075fe33b5793364090c55d9cf743e61e52a453daf6.dll
-
Size
333KB
-
MD5
ca91c16904dcf84520cd41417285f0bc
-
SHA1
f261b0943ce84cd4ead5fdc73694bc2f6113c4f1
-
SHA256
277c5272ac242f4f737cae075fe33b5793364090c55d9cf743e61e52a453daf6
-
SHA512
c22c9bf6dadf6671465441a26ba1a0fe7d8d68bd6ab49087d10262e9c773cbe3baa2aa1bc328c3e990ea6f5e4b27f5b9411ed319fa28e76bdd89d3eea76f3c3a
Malware Config
Extracted
squirrelwaffle
http://atertreat.in/5iPPVRKPPX9
http://incentivaconsultores.com.co/55jHpKCc9DWy
http://cdelean.org/0qvbbmu9g
http://bazy.ps/M6SjrMSYC
http://sukmabali.com/ZXxcLYs3rzRQ
http://bugwilliam.tk/cbB56YrugdbW
http://bestbeatsgh.com/42D7OwuPen
http://krumaila.com/UZ4NdDoDh4Tu
http://razehub.com/NN70nExbtLO
http://arcb.ro/aHUUNxE3Me5
http://cfmi.tg/m40YS6gDO0
http://sweetlittle.mx/ZCXP0dT2h
http://alkimia-prod.com/nT0imyzmo
http://almexperts.co.za/fEoJ3pdWZbF
Signatures
-
SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
-
Squirrelwaffle Payload 1 IoCs
resource yara_rule behavioral1/memory/1248-57-0x0000000010000000-0x000000001004D000-memory.dmp squirrelwaffle -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1620 wrote to memory of 1248 1620 rundll32.exe 27 PID 1620 wrote to memory of 1248 1620 rundll32.exe 27 PID 1620 wrote to memory of 1248 1620 rundll32.exe 27 PID 1620 wrote to memory of 1248 1620 rundll32.exe 27 PID 1620 wrote to memory of 1248 1620 rundll32.exe 27 PID 1620 wrote to memory of 1248 1620 rundll32.exe 27 PID 1620 wrote to memory of 1248 1620 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\277c5272ac242f4f737cae075fe33b5793364090c55d9cf743e61e52a453daf6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\277c5272ac242f4f737cae075fe33b5793364090c55d9cf743e61e52a453daf6.dll,#12⤵PID:1248
-