Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28/10/2022, 01:23
Static task
static1
Behavioral task
behavioral1
Sample
Details.lnk
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
Details.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
disallowable/lavatory.dll
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral4
Sample
disallowable/lavatory.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
disallowable/leggings.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
disallowable/leggings.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
disallowable/lavatory.dll
-
Size
422KB
-
MD5
44dc7cee0491d88c106a03ba4a147b3a
-
SHA1
b192eb80bcc6bc68689f7eaca2f22bceaca05a26
-
SHA256
cc816cb9b0bc626a5c5c7dd9143565b31edd1458ee67a4d6e89dcc640679f871
-
SHA512
f2e04b214b1acc8ca03cdaf7fc8d4941ccd9b0d57ecae256401f4277f8b450104098367cb3f8f152ea394a3515cbd70f4f994f910891bb3965a28fd367125002
-
SSDEEP
12288:eqdD/sblafl4M/8toGXJZ6diNjNo8Ywr6t57AKC:eqdclafl4eGXuiNq8Ye6c
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1672 regsvr32.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe 1780 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1672 regsvr32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1268 wrote to memory of 1672 1268 regsvr32.exe 27 PID 1268 wrote to memory of 1672 1268 regsvr32.exe 27 PID 1268 wrote to memory of 1672 1268 regsvr32.exe 27 PID 1268 wrote to memory of 1672 1268 regsvr32.exe 27 PID 1268 wrote to memory of 1672 1268 regsvr32.exe 27 PID 1268 wrote to memory of 1672 1268 regsvr32.exe 27 PID 1268 wrote to memory of 1672 1268 regsvr32.exe 27 PID 1672 wrote to memory of 1780 1672 regsvr32.exe 28 PID 1672 wrote to memory of 1780 1672 regsvr32.exe 28 PID 1672 wrote to memory of 1780 1672 regsvr32.exe 28 PID 1672 wrote to memory of 1780 1672 regsvr32.exe 28 PID 1672 wrote to memory of 1780 1672 regsvr32.exe 28 PID 1672 wrote to memory of 1780 1672 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\disallowable\lavatory.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\disallowable\lavatory.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1780
-
-