Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10/10/2022, 22:15
Static task
static1
Behavioral task
behavioral1
Sample
3550/3962.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
3550/3962.cmd
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
3550/candlestick.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
3550/candlestick.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
New_documents.lnk
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
New_documents.lnk
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
3550/candlestick.dll
-
Size
1.4MB
-
MD5
d2b373df1eb012c206269049e636d26f
-
SHA1
e291ce3f2496a72851270c05ffb43017827453c3
-
SHA256
80556052a05684ca0f8729c182aa3a48abb040fe5e358b6f67833b52dbd1c172
-
SHA512
21de696001564c674cf7a1803595a9d13acf1888962223bb24b8d92c043e5b6899eb2ac1d4cdbcdb39fdd60c965f7952607fa1e7d2bcdc4cdf8564c574dcf88a
-
SSDEEP
12288:YYKepSeIUqeXPwyITtxGvvVeHTe7ezGNTTYmRs867u0iROkDQSpu8ahK+UfxEeEK:BLo2ftMzeaKYKu7u0i9wofxEaz32w
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2008 rundll32.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe 1508 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2008 rundll32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 740 wrote to memory of 2008 740 rundll32.exe 27 PID 740 wrote to memory of 2008 740 rundll32.exe 27 PID 740 wrote to memory of 2008 740 rundll32.exe 27 PID 740 wrote to memory of 2008 740 rundll32.exe 27 PID 740 wrote to memory of 2008 740 rundll32.exe 27 PID 740 wrote to memory of 2008 740 rundll32.exe 27 PID 740 wrote to memory of 2008 740 rundll32.exe 27 PID 2008 wrote to memory of 1508 2008 rundll32.exe 28 PID 2008 wrote to memory of 1508 2008 rundll32.exe 28 PID 2008 wrote to memory of 1508 2008 rundll32.exe 28 PID 2008 wrote to memory of 1508 2008 rundll32.exe 28 PID 2008 wrote to memory of 1508 2008 rundll32.exe 28 PID 2008 wrote to memory of 1508 2008 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3550\candlestick.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3550\candlestick.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1508
-
-