Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
69s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 20:24
Static task
static1
Behavioral task
behavioral1
Sample
39c25b45fb1cd7cfc3000bf0060799052000124ac10607f51d16e71e5dc35592.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
39c25b45fb1cd7cfc3000bf0060799052000124ac10607f51d16e71e5dc35592.dll
Resource
win10v2004-20220812-en
General
-
Target
39c25b45fb1cd7cfc3000bf0060799052000124ac10607f51d16e71e5dc35592.dll
-
Size
216KB
-
MD5
3bc080b863aa68efa4a7a291c75e9ba9
-
SHA1
5c0b8b7a65e5437bdf0ce28839ac192108096f03
-
SHA256
39c25b45fb1cd7cfc3000bf0060799052000124ac10607f51d16e71e5dc35592
-
SHA512
28ae6ce0275037d0ea2de404be987089b4cad7ea5535565acf52596ba3740960b32cd92be568b6daf2caf1e6a7e8756c9ac8de49cef2c04fd3f9c2fe247b3c20
-
SSDEEP
6144:sv80ayHyYc7roVdQTuYOiWB1z1GC53DItkjzfip:sv8loDQy7DzZDzy
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 4 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0006000000022e21-137.dat acprotect behavioral2/files/0x0006000000022e21-136.dat acprotect behavioral2/files/0x0007000000022e1f-140.dat acprotect behavioral2/files/0x0007000000022e1f-141.dat acprotect -
Executes dropped EXE 2 IoCs
pid Process 4852 hrl835E.tmp 4760 bgjrgk.exe -
Loads dropped DLL 4 IoCs
pid Process 4852 hrl835E.tmp 4852 hrl835E.tmp 4760 bgjrgk.exe 4760 bgjrgk.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\bgjrgk.exe hrl835E.tmp File opened for modification C:\Windows\SysWOW64\bgjrgk.exe hrl835E.tmp -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4852 hrl835E.tmp -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4852 hrl835E.tmp 4760 bgjrgk.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4876 wrote to memory of 4764 4876 rundll32.exe 85 PID 4876 wrote to memory of 4764 4876 rundll32.exe 85 PID 4876 wrote to memory of 4764 4876 rundll32.exe 85 PID 4764 wrote to memory of 4852 4764 rundll32.exe 86 PID 4764 wrote to memory of 4852 4764 rundll32.exe 86 PID 4764 wrote to memory of 4852 4764 rundll32.exe 86 PID 4760 wrote to memory of 4900 4760 bgjrgk.exe 88 PID 4760 wrote to memory of 4900 4760 bgjrgk.exe 88 PID 4760 wrote to memory of 4900 4760 bgjrgk.exe 88 PID 4852 wrote to memory of 2740 4852 hrl835E.tmp 89 PID 4852 wrote to memory of 2740 4852 hrl835E.tmp 89 PID 4852 wrote to memory of 2740 4852 hrl835E.tmp 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39c25b45fb1cd7cfc3000bf0060799052000124ac10607f51d16e71e5dc35592.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39c25b45fb1cd7cfc3000bf0060799052000124ac10607f51d16e71e5dc35592.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\hrl835E.tmpC:\Users\Admin\AppData\Local\Temp\hrl835E.tmp3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\hrl835E.tmp > nul4⤵PID:2740
-
-
-
-
C:\Windows\SysWOW64\bgjrgk.exeC:\Windows\SysWOW64\bgjrgk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:4900
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
209KB
MD5d5450d1885577b308d0c081acc8dcd0b
SHA15950c3ec40d452073e96438f60b9af67163fc87d
SHA2564fd0feb1affaaf2790e36ffc86a72c9ced3077020d9037fbc62950f7b4becd2f
SHA512b0014a28244a33d2daf4d03d0bfaa487607158564b8993dfbaff6b193066bc8bbba1feac1ec7054e93ffa4867c7e0d7226caa36233887a9c9e8352aeb8115046
-
Filesize
209KB
MD5d5450d1885577b308d0c081acc8dcd0b
SHA15950c3ec40d452073e96438f60b9af67163fc87d
SHA2564fd0feb1affaaf2790e36ffc86a72c9ced3077020d9037fbc62950f7b4becd2f
SHA512b0014a28244a33d2daf4d03d0bfaa487607158564b8993dfbaff6b193066bc8bbba1feac1ec7054e93ffa4867c7e0d7226caa36233887a9c9e8352aeb8115046
-
Filesize
209KB
MD5d5450d1885577b308d0c081acc8dcd0b
SHA15950c3ec40d452073e96438f60b9af67163fc87d
SHA2564fd0feb1affaaf2790e36ffc86a72c9ced3077020d9037fbc62950f7b4becd2f
SHA512b0014a28244a33d2daf4d03d0bfaa487607158564b8993dfbaff6b193066bc8bbba1feac1ec7054e93ffa4867c7e0d7226caa36233887a9c9e8352aeb8115046
-
Filesize
209KB
MD5d5450d1885577b308d0c081acc8dcd0b
SHA15950c3ec40d452073e96438f60b9af67163fc87d
SHA2564fd0feb1affaaf2790e36ffc86a72c9ced3077020d9037fbc62950f7b4becd2f
SHA512b0014a28244a33d2daf4d03d0bfaa487607158564b8993dfbaff6b193066bc8bbba1feac1ec7054e93ffa4867c7e0d7226caa36233887a9c9e8352aeb8115046
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9