Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
156s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15/02/2022, 14:38
Static task
static1
Behavioral task
behavioral1
Sample
bc6a441a3036c1310886b671943e487d47f2c7d1b4bd125d7b0cf0f3090b8281.dll
Resource
win7-en-20211208
0 signatures
0 seconds
General
Malware Config
Extracted
Family
icedid
Campaign
412701809
C2
hdtrenity.com
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1800 1864 WerFault.exe 26 -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1864 regsvr32.exe 1864 regsvr32.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1800 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1864 wrote to memory of 1800 1864 regsvr32.exe 29 PID 1864 wrote to memory of 1800 1864 regsvr32.exe 29 PID 1864 wrote to memory of 1800 1864 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\bc6a441a3036c1310886b671943e487d47f2c7d1b4bd125d7b0cf0f3090b8281.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1864 -s 2442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800
-