Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
137s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
30/01/2022, 16:14
Static task
static1
Behavioral task
behavioral1
Sample
1757c15eee855f947a07dc1c17c9ed03d8d7037cabe7ddc0e00e25666b5339c1.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
1757c15eee855f947a07dc1c17c9ed03d8d7037cabe7ddc0e00e25666b5339c1.dll
Resource
win10-en-20211208
General
-
Target
1757c15eee855f947a07dc1c17c9ed03d8d7037cabe7ddc0e00e25666b5339c1.dll
-
Size
303KB
-
MD5
73a0e338895d74e9933d28983c1ccb92
-
SHA1
dca3450c3575d6fe3b107dd2a176495a8ab6d30a
-
SHA256
1757c15eee855f947a07dc1c17c9ed03d8d7037cabe7ddc0e00e25666b5339c1
-
SHA512
2e889b62aa3027e00c7f98ef3db546dfa7a7bff0794e360da05fc6212cf9b0128c0ca351e60c36b8a09c212939ba931e2097cd8f4242dd21d1a4c8a29e24b4a9
Malware Config
Extracted
squirrelwaffle
http://atertreat.in/5iPPVRKPPX9
http://incentivaconsultores.com.co/55jHpKCc9DWy
http://cdelean.org/0qvbbmu9g
http://bazy.ps/M6SjrMSYC
http://sukmabali.com/ZXxcLYs3rzRQ
http://bugwilliam.tk/cbB56YrugdbW
http://bestbeatsgh.com/42D7OwuPen
http://krumaila.com/UZ4NdDoDh4Tu
http://razehub.com/NN70nExbtLO
http://arcb.ro/aHUUNxE3Me5
http://cfmi.tg/m40YS6gDO0
http://sweetlittle.mx/ZCXP0dT2h
http://alkimia-prod.com/nT0imyzmo
http://almexperts.co.za/fEoJ3pdWZbF
Signatures
-
SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
-
Squirrelwaffle Payload 1 IoCs
resource yara_rule behavioral1/memory/768-56-0x0000000010000000-0x000000001004D000-memory.dmp squirrelwaffle -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 520 wrote to memory of 768 520 rundll32.exe 27 PID 520 wrote to memory of 768 520 rundll32.exe 27 PID 520 wrote to memory of 768 520 rundll32.exe 27 PID 520 wrote to memory of 768 520 rundll32.exe 27 PID 520 wrote to memory of 768 520 rundll32.exe 27 PID 520 wrote to memory of 768 520 rundll32.exe 27 PID 520 wrote to memory of 768 520 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1757c15eee855f947a07dc1c17c9ed03d8d7037cabe7ddc0e00e25666b5339c1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1757c15eee855f947a07dc1c17c9ed03d8d7037cabe7ddc0e00e25666b5339c1.dll,#12⤵PID:768
-