Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    45s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    15/04/2022, 13:05

General

  • Target

    3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0.dll

  • Size

    2.0MB

  • MD5

    19743d8e8590b5f644d452a9ddd77435

  • SHA1

    28c454042b155c4356c2a78b64c25ddf020b8eba

  • SHA256

    3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0

  • SHA512

    5743c1a3112ee13aefd30f8f3291a32b31e04782c23f03a64c3996d30022c6c5c0051f945450f814a0834758488eb9e0dc3481d706c7b643011cd06c19f8aa71

Score
1/10

Malware Config

Signatures

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e3a6c6658c7352b6415b1a0b5d7e22716f39a686c52e048200cc07f185be2f0.dll,#1
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1504
    • C:\Windows\System32\cmd.exe
      /c "dir"
      2⤵
        PID:360
      • C:\Windows\System32\cmd.exe
        /c "set"
        2⤵
          PID:536
        • C:\Windows\System32\cmd.exe
          /c "ipconfig /all"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1916
          • C:\Windows\system32\ipconfig.exe
            ipconfig /all
            3⤵
            • Gathers network information
            PID:2036
        • \??\c:\program files\internet explorer\iexplore.exe
          "c:\program files\internet explorer\iexplore.exe"
          2⤵
            PID:1984
          • C:\Windows\System32\calc.exe
            "C:\Windows\System32\calc.exe"
            2⤵
              PID:984
            • \??\c:\program files\internet explorer\iexplore.exe
              "c:\program files\internet explorer\iexplore.exe"
              2⤵
                PID:1020
              • C:\Windows\System32\calc.exe
                "C:\Windows\System32\calc.exe"
                2⤵
                  PID:1088
                • \??\c:\program files\internet explorer\iexplore.exe
                  "c:\program files\internet explorer\iexplore.exe"
                  2⤵
                    PID:1600
                  • C:\Windows\System32\calc.exe
                    "C:\Windows\System32\calc.exe"
                    2⤵
                      PID:1608

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/984-58-0x0000000000060000-0x0000000000061000-memory.dmp

                    Filesize

                    4KB

                  • memory/984-60-0x000007FEFC0B1000-0x000007FEFC0B3000-memory.dmp

                    Filesize

                    8KB

                  • memory/1984-78-0x0000000000060000-0x0000000000073000-memory.dmp

                    Filesize

                    76KB

                  • memory/1984-80-0x0000000000060000-0x0000000000073000-memory.dmp

                    Filesize

                    76KB

                  • memory/1984-81-0x0000000000060000-0x0000000000073000-memory.dmp

                    Filesize

                    76KB