Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
19/10/2022, 05:21
221019-f2f5ssfchl 1013/10/2022, 08:23
221013-j98rkabee4 111/10/2022, 23:51
221011-3v5adabff8 3Analysis
-
max time kernel
600s -
max time network
603s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
13/10/2022, 08:23
Static task
static1
Behavioral task
behavioral1
Sample
cossacks.dat.dll
Resource
win7-20220901-en
windows7-x64
6 signatures
600 seconds
General
-
Target
cossacks.dat.dll
-
Size
743KB
-
MD5
25d8d740a5611fb6ab2e6df583c24a00
-
SHA1
41142c72f3f37fad22b01c6bd9eaf572551ff465
-
SHA256
9ebb684f13367a8b7817b787a5374f9072f9338d657c255403d991f50f6ce80c
-
SHA512
2de372428bac53af5fca71e443c6f9d7ebed9bf75faf76295c5f87aad1b1a51d6c6bbe5eb418cf9a5b65d29f81bb69a2bd64cfa9cdb640c9c259f2c43f57856b
-
SSDEEP
12288:e+4QHixeljmtjVFJcPp+cygICZoxlSr9p6q6xMZXJMeGbX//7OT:5DXjmtjVD3cygICZwSJp6q6yZXJM5T/c
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1760 rundll32.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 1280 wermgr.exe 916 taskmgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe 1280 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1760 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 916 taskmgr.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe -
Suspicious use of SendNotifyMessage 33 IoCs
pid Process 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe 916 taskmgr.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 852 wrote to memory of 1760 852 rundll32.exe 27 PID 852 wrote to memory of 1760 852 rundll32.exe 27 PID 852 wrote to memory of 1760 852 rundll32.exe 27 PID 852 wrote to memory of 1760 852 rundll32.exe 27 PID 852 wrote to memory of 1760 852 rundll32.exe 27 PID 852 wrote to memory of 1760 852 rundll32.exe 27 PID 852 wrote to memory of 1760 852 rundll32.exe 27 PID 1760 wrote to memory of 1280 1760 rundll32.exe 29 PID 1760 wrote to memory of 1280 1760 rundll32.exe 29 PID 1760 wrote to memory of 1280 1760 rundll32.exe 29 PID 1760 wrote to memory of 1280 1760 rundll32.exe 29 PID 1760 wrote to memory of 1280 1760 rundll32.exe 29 PID 1760 wrote to memory of 1280 1760 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cossacks.dat.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cossacks.dat.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1280
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:916