Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 13:18
Static task
static1
Behavioral task
behavioral1
Sample
9cdd65c79921a2dd62616ab5b94dcd7123d13038fc097627f91162e4d9a3db5c.dll
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
9cdd65c79921a2dd62616ab5b94dcd7123d13038fc097627f91162e4d9a3db5c.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
9cdd65c79921a2dd62616ab5b94dcd7123d13038fc097627f91162e4d9a3db5c.dll
-
Size
667KB
-
MD5
a086e03be718ed752d880d21ab9cdb50
-
SHA1
3d720f928d9791696365bfc19d0bdc4ca371c55e
-
SHA256
9cdd65c79921a2dd62616ab5b94dcd7123d13038fc097627f91162e4d9a3db5c
-
SHA512
1c73e1170f2c438cf18fdcf586b4bde3afaf98c013554000f33ca0e7e276aa3c3b521b281a012fe4848dbe5902bb512c2c6ae5ad8d16c929c810155c82e95ee5
-
SSDEEP
12288:bzb9rMfc+CKUQyUmjtc4euuzPrs9pGp8hunWoopooK9kwP:bzb1MlCKUQyUmjtczu6Prs9pgWoopoo6
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1464 rundll32Srv.exe -
resource yara_rule behavioral2/files/0x0003000000022dd6-134.dat upx behavioral2/files/0x0003000000022dd6-135.dat upx behavioral2/memory/1464-137-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/1464-138-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32Srv.exe rundll32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-conio-l1-1-0.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledb32r.dll rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java_crw_demo.dll rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OsfTaskengine.dll rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr3jp.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe rundll32Srv.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\EEINTL.DLL rundll32Srv.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\plugin2\msvcr100.dll rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll rundll32Srv.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\msvcr120.dll rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\JitV.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll rundll32Srv.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GKWord.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jsoundds.dll rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\SLINTL.DLL rundll32Srv.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\fxplugins.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\C2R64.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\splashscreen.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html rundll32Srv.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\instrument.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\bci.dll rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\prism_common.dll rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll rundll32Srv.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-timezone-l1-1-0.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jfr.dll rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msvcp120.dll rundll32Srv.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-stdio-l1-1-0.dll rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe rundll32Srv.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe rundll32Srv.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 648 wrote to memory of 4796 648 rundll32.exe 82 PID 648 wrote to memory of 4796 648 rundll32.exe 82 PID 648 wrote to memory of 4796 648 rundll32.exe 82 PID 4796 wrote to memory of 1464 4796 rundll32.exe 84 PID 4796 wrote to memory of 1464 4796 rundll32.exe 84 PID 4796 wrote to memory of 1464 4796 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9cdd65c79921a2dd62616ab5b94dcd7123d13038fc097627f91162e4d9a3db5c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9cdd65c79921a2dd62616ab5b94dcd7123d13038fc097627f91162e4d9a3db5c.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\rundll32Srv.exeC:\Windows\SysWOW64\rundll32Srv.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1464
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD59f7f94a22e1ed7f03995292038b35b98
SHA1c4c5a6e26687e788b3a0859aa0e6f1917a7334c2
SHA256a7a43eef41b32a366e865ca71c160ff23e831cce9a28937ff7cd212acd2109e3
SHA512f775bbddc1f594984c5f7d7b88d211d5ddbd54d2fed1c92ae11b5007f6ef3e00b614f729253c77b8f1471b328dbd6be585309414b4310f0c2840dedb9a743bb4
-
Filesize
10KB
MD59f7f94a22e1ed7f03995292038b35b98
SHA1c4c5a6e26687e788b3a0859aa0e6f1917a7334c2
SHA256a7a43eef41b32a366e865ca71c160ff23e831cce9a28937ff7cd212acd2109e3
SHA512f775bbddc1f594984c5f7d7b88d211d5ddbd54d2fed1c92ae11b5007f6ef3e00b614f729253c77b8f1471b328dbd6be585309414b4310f0c2840dedb9a743bb4