Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
187s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 06:21
Static task
static1
Behavioral task
behavioral1
Sample
938011ca2182016c5a3cd3c9224158087796ee37b10f5d914c5ded9103a12eeb.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
938011ca2182016c5a3cd3c9224158087796ee37b10f5d914c5ded9103a12eeb.dll
Resource
win10v2004-20220812-en
General
-
Target
938011ca2182016c5a3cd3c9224158087796ee37b10f5d914c5ded9103a12eeb.dll
-
Size
380KB
-
MD5
0c8d72344230c0625f366c89f6ff84f3
-
SHA1
67df7f93c4c30ed3c9d152e14eea96b3ec861750
-
SHA256
938011ca2182016c5a3cd3c9224158087796ee37b10f5d914c5ded9103a12eeb
-
SHA512
56697473ec59b45cf4a99f6f407d9a373ae0b78bcbd750c65354bd888cc44053673fa80013a2a6ef4c8ce77ba10febb3072252290d55fa525ee5b95ece8e8187
-
SSDEEP
6144:1hcH2NKtrIWbJvZ9k3wmgzPvYVdljGo+kK++EbZlUxxm+lCJ:vcH2NKqWbJB9kbkHYVTjGo+b+TUZO
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\03a rundll32.exe File created C:\Windows\SysWOW64\117737-15 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 424 wrote to memory of 1548 424 rundll32.exe 79 PID 424 wrote to memory of 1548 424 rundll32.exe 79 PID 424 wrote to memory of 1548 424 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\938011ca2182016c5a3cd3c9224158087796ee37b10f5d914c5ded9103a12eeb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\938011ca2182016c5a3cd3c9224158087796ee37b10f5d914c5ded9103a12eeb.dll,#12⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
PID:1548
-