Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08/10/2022, 12:35
Static task
static1
Behavioral task
behavioral1
Sample
6438/3772.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
6438/3772.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
6438/grassing.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
6438/grassing.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Overdue.lnk
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral6
Sample
Overdue.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
6438/grassing.dll
-
Size
386KB
-
MD5
f6f4f1bbe873a35bdfffffc0c00b61af
-
SHA1
7d831da7bd7aa594b4efa0f07ea9ee0748fdb9cb
-
SHA256
9ef5f5a55db078bbcf60cb9750349ab35f3ef88e8c5574f23fb77a485d0ba603
-
SHA512
6803d2324c13625c50cd8564af9fc2947e277c2c2b9a5aa27d740eb05bde9847795c105f73f515b1f887b2b313287e0db10c19b2e444be87588a7fc04a500e58
-
SSDEEP
6144:XtgTFlqteWTBa5WsoUReNsyLK998WqniKS9jyA9yjHHXsBcfmL/p+LIORL6qYFYM:d8z4TU5WsoURzN92tniPHlQEFYM
Malware Config
Extracted
qakbot
78.94.148.92:1753
134.180.185.240:32987
201.136.101.182:38323
124.77.95.5:46163
196.90.29.190:30693
187.144.110.117:36330
10.44.33.140:65267
162.117.200.91:29984
159.254.223.192:31154
11.239.81.233:37
31.248.76.23:24072
224.77.182.18:55579
124.230.27.11:44408
205.255.39.94:54675
192.1.213.104:14212
145.3.120.239:20068
242.199.30.106:9157
243.240.195.106:42825
74.234.32.185:42698
102.51.5.67:47820
43.190.241.127:50708
29.119.168.182:51370
54.106.172.208:21101
76.55.174.209:2746
71.182.193.130:5327
111.143.132.167:9985
173.210.161.232:27188
22.155.219.162:29117
167.159.67.2:42455
80.214.112.151:9618
75.86.4.24:35165
106.146.239.56:49679
194.127.196.112:59762
64.184.233.29:48193
218.86.11.123:62100
108.87.254.103:36138
240.129.151.227:4400
96.117.66.72:0
48.220.224.248:32917
240.164.22.246:57048
224.87.85.180:40164
214.9.213.13:12523
117.180.92.184:46633
73.23.253.56:17393
162.74.55.118:4571
9.252.189.253:60714
101.200.152.191:46287
110.117.95.0:0
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2032 regsvr32.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe 276 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2032 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1948 wrote to memory of 2032 1948 regsvr32.exe 28 PID 1948 wrote to memory of 2032 1948 regsvr32.exe 28 PID 1948 wrote to memory of 2032 1948 regsvr32.exe 28 PID 1948 wrote to memory of 2032 1948 regsvr32.exe 28 PID 1948 wrote to memory of 2032 1948 regsvr32.exe 28 PID 1948 wrote to memory of 2032 1948 regsvr32.exe 28 PID 1948 wrote to memory of 2032 1948 regsvr32.exe 28 PID 2032 wrote to memory of 276 2032 regsvr32.exe 29 PID 2032 wrote to memory of 276 2032 regsvr32.exe 29 PID 2032 wrote to memory of 276 2032 regsvr32.exe 29 PID 2032 wrote to memory of 276 2032 regsvr32.exe 29 PID 2032 wrote to memory of 276 2032 regsvr32.exe 29 PID 2032 wrote to memory of 276 2032 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\6438\grassing.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\6438\grassing.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:276
-
-