Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
27/10/2022, 17:04
Static task
static1
Behavioral task
behavioral1
Sample
Details.lnk
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
Details.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
disallowable/bankbook.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
disallowable/bankbook.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
disallowable/tenuit.dll
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral6
Sample
disallowable/tenuit.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
disallowable/tenuit.dll
-
Size
422KB
-
MD5
8492d15cba84b109e4bda2ec1aefb3e6
-
SHA1
922e35df6f122b3e511dd8172b20a5c7867b230b
-
SHA256
2e5e876270f2b06a0aaafa0b11e31dec80cf5098c11344c9335567f0c706d392
-
SHA512
633abf5cc4ffc78bf3b8396412d9d265f4d3625eded78170c26900bb8833304004f35ccbfe280083a1eeb0d6b2d00f6aa73df714fcf630585cef0ba6fdfe18aa
-
SSDEEP
12288:eqdD/sblafl4M/8toGXJZ6diNj1o8Ywr6t57AKC:eqdclafl4eGXuiNS8Ye6c
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 900 regsvr32.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe 1464 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 900 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1060 wrote to memory of 900 1060 regsvr32.exe 27 PID 1060 wrote to memory of 900 1060 regsvr32.exe 27 PID 1060 wrote to memory of 900 1060 regsvr32.exe 27 PID 1060 wrote to memory of 900 1060 regsvr32.exe 27 PID 1060 wrote to memory of 900 1060 regsvr32.exe 27 PID 1060 wrote to memory of 900 1060 regsvr32.exe 27 PID 1060 wrote to memory of 900 1060 regsvr32.exe 27 PID 900 wrote to memory of 1464 900 regsvr32.exe 28 PID 900 wrote to memory of 1464 900 regsvr32.exe 28 PID 900 wrote to memory of 1464 900 regsvr32.exe 28 PID 900 wrote to memory of 1464 900 regsvr32.exe 28 PID 900 wrote to memory of 1464 900 regsvr32.exe 28 PID 900 wrote to memory of 1464 900 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\disallowable\tenuit.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\disallowable\tenuit.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1464
-
-