Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
39s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28/10/2022, 20:40
Static task
static1
Behavioral task
behavioral1
Sample
d06b00bdd5265775a9a333ebcbb32c18c88c1c9bff23fa5438950bf34606f9d2.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d06b00bdd5265775a9a333ebcbb32c18c88c1c9bff23fa5438950bf34606f9d2.dll
Resource
win10v2004-20220812-en
General
-
Target
d06b00bdd5265775a9a333ebcbb32c18c88c1c9bff23fa5438950bf34606f9d2.dll
-
Size
1.1MB
-
MD5
0c02dcf6109dde488973cbb7039bbce0
-
SHA1
b79fd1ea630031b6884b5f7db33bd69a83db3ef2
-
SHA256
d06b00bdd5265775a9a333ebcbb32c18c88c1c9bff23fa5438950bf34606f9d2
-
SHA512
dcf95180af45bcd00ebccb9b282428590ccd915cb286e01b6550dde3823bc80864603a2e826f767bc9100e87a183bae1a404a5c623caf91bac489215f8e6157d
-
SSDEEP
24576:DnpCMj+KpP5Wx6QpBf+Vf0a6v9SG8Bk+sc/poFAPVW+VhWGs:fId40pv8G8Bk/c/pouVW+LWG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1604 rundll32Srv.exe -
resource yara_rule behavioral1/files/0x0007000000005c50-56.dat upx behavioral1/files/0x0007000000005c50-57.dat upx behavioral1/files/0x0007000000005c50-59.dat upx behavioral1/files/0x0007000000005c50-60.dat upx behavioral1/memory/1604-61-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/1604-62-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1260 rundll32.exe 1260 rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32Srv.exe rundll32.exe -
Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\RMNetwork\pxC035.tmp rundll32Srv.exe File opened for modification C:\Program Files (x86)\RMNetwork\px3823.tmp rundll32Srv.exe File opened for modification C:\Program Files\7-Zip\7z.exe rundll32Srv.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe rundll32Srv.exe File opened for modification C:\Program Files\7-Zip\7zG.exe rundll32Srv.exe File opened for modification C:\Program Files (x86)\RMNetwork\px45B8.tmp rundll32Srv.exe File opened for modification C:\Program Files (x86)\RMNetwork\pxB011.tmp rundll32Srv.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll rundll32Srv.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll rundll32Srv.exe File opened for modification C:\Program Files\7-Zip\7z.dll rundll32Srv.exe File opened for modification C:\Program Files (x86)\RMNetwork\px27FF.tmp rundll32Srv.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1488 wrote to memory of 1260 1488 rundll32.exe 27 PID 1488 wrote to memory of 1260 1488 rundll32.exe 27 PID 1488 wrote to memory of 1260 1488 rundll32.exe 27 PID 1488 wrote to memory of 1260 1488 rundll32.exe 27 PID 1488 wrote to memory of 1260 1488 rundll32.exe 27 PID 1488 wrote to memory of 1260 1488 rundll32.exe 27 PID 1488 wrote to memory of 1260 1488 rundll32.exe 27 PID 1260 wrote to memory of 1604 1260 rundll32.exe 28 PID 1260 wrote to memory of 1604 1260 rundll32.exe 28 PID 1260 wrote to memory of 1604 1260 rundll32.exe 28 PID 1260 wrote to memory of 1604 1260 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d06b00bdd5265775a9a333ebcbb32c18c88c1c9bff23fa5438950bf34606f9d2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d06b00bdd5265775a9a333ebcbb32c18c88c1c9bff23fa5438950bf34606f9d2.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\rundll32Srv.exeC:\Windows\SysWOW64\rundll32Srv.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1604
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD59f7f94a22e1ed7f03995292038b35b98
SHA1c4c5a6e26687e788b3a0859aa0e6f1917a7334c2
SHA256a7a43eef41b32a366e865ca71c160ff23e831cce9a28937ff7cd212acd2109e3
SHA512f775bbddc1f594984c5f7d7b88d211d5ddbd54d2fed1c92ae11b5007f6ef3e00b614f729253c77b8f1471b328dbd6be585309414b4310f0c2840dedb9a743bb4
-
Filesize
10KB
MD59f7f94a22e1ed7f03995292038b35b98
SHA1c4c5a6e26687e788b3a0859aa0e6f1917a7334c2
SHA256a7a43eef41b32a366e865ca71c160ff23e831cce9a28937ff7cd212acd2109e3
SHA512f775bbddc1f594984c5f7d7b88d211d5ddbd54d2fed1c92ae11b5007f6ef3e00b614f729253c77b8f1471b328dbd6be585309414b4310f0c2840dedb9a743bb4
-
Filesize
10KB
MD59f7f94a22e1ed7f03995292038b35b98
SHA1c4c5a6e26687e788b3a0859aa0e6f1917a7334c2
SHA256a7a43eef41b32a366e865ca71c160ff23e831cce9a28937ff7cd212acd2109e3
SHA512f775bbddc1f594984c5f7d7b88d211d5ddbd54d2fed1c92ae11b5007f6ef3e00b614f729253c77b8f1471b328dbd6be585309414b4310f0c2840dedb9a743bb4
-
Filesize
10KB
MD59f7f94a22e1ed7f03995292038b35b98
SHA1c4c5a6e26687e788b3a0859aa0e6f1917a7334c2
SHA256a7a43eef41b32a366e865ca71c160ff23e831cce9a28937ff7cd212acd2109e3
SHA512f775bbddc1f594984c5f7d7b88d211d5ddbd54d2fed1c92ae11b5007f6ef3e00b614f729253c77b8f1471b328dbd6be585309414b4310f0c2840dedb9a743bb4