Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
185s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 07:16
Static task
static1
Behavioral task
behavioral1
Sample
52831d2198afb6e9f624cea7bb9e7bec5b74fc22314380f4282d509e0f1c1d56.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
52831d2198afb6e9f624cea7bb9e7bec5b74fc22314380f4282d509e0f1c1d56.dll
Resource
win10v2004-20220901-en
General
-
Target
52831d2198afb6e9f624cea7bb9e7bec5b74fc22314380f4282d509e0f1c1d56.dll
-
Size
24KB
-
MD5
08afb75035b9a9ac996aa7881a2002c4
-
SHA1
d88cd24c3071e7a980c9b92f08aa99582d3a3e3f
-
SHA256
52831d2198afb6e9f624cea7bb9e7bec5b74fc22314380f4282d509e0f1c1d56
-
SHA512
b4d9a913c05239a5bec1c446b4e13da13e1104a4361e7d46debf0f9890bec5227bad39412cacfba0d945578231133ee8776108236c46ad3b9a03ec07fcf1c132
-
SSDEEP
384:fDyf5QHH7jIR0hmjdPRkkMv8dLLOgvHGk/2z7QYxx8:2xQHbSIOdPRB5pZvHz/2Yh
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
pid Process 280 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MSServer = "rundll32.exe C:\\Windows\\system32\\khfDtQGx.dll,#1" rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\khfDtQGx.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\khfDtQGx.dll rundll32.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7A48EFB-4B9D-4531-84A1-68A938B3FF23} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7A48EFB-4B9D-4531-84A1-68A938B3FF23}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7A48EFB-4B9D-4531-84A1-68A938B3FF23}\InprocServer32\ = "C:\\Windows\\SysWow64\\khfDtQGx.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7A48EFB-4B9D-4531-84A1-68A938B3FF23}\InprocServer32\ThreadingModel = "Both" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe 944 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 280 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1284 wrote to memory of 280 1284 rundll32.exe 28 PID 1284 wrote to memory of 280 1284 rundll32.exe 28 PID 1284 wrote to memory of 280 1284 rundll32.exe 28 PID 1284 wrote to memory of 280 1284 rundll32.exe 28 PID 1284 wrote to memory of 280 1284 rundll32.exe 28 PID 1284 wrote to memory of 280 1284 rundll32.exe 28 PID 1284 wrote to memory of 280 1284 rundll32.exe 28 PID 280 wrote to memory of 944 280 rundll32.exe 29 PID 280 wrote to memory of 944 280 rundll32.exe 29 PID 280 wrote to memory of 944 280 rundll32.exe 29 PID 280 wrote to memory of 944 280 rundll32.exe 29 PID 280 wrote to memory of 944 280 rundll32.exe 29 PID 280 wrote to memory of 944 280 rundll32.exe 29 PID 280 wrote to memory of 944 280 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\52831d2198afb6e9f624cea7bb9e7bec5b74fc22314380f4282d509e0f1c1d56.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\52831d2198afb6e9f624cea7bb9e7bec5b74fc22314380f4282d509e0f1c1d56.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:280 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\system32\khfDtQGx.dll,a3⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:944
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD508afb75035b9a9ac996aa7881a2002c4
SHA1d88cd24c3071e7a980c9b92f08aa99582d3a3e3f
SHA25652831d2198afb6e9f624cea7bb9e7bec5b74fc22314380f4282d509e0f1c1d56
SHA512b4d9a913c05239a5bec1c446b4e13da13e1104a4361e7d46debf0f9890bec5227bad39412cacfba0d945578231133ee8776108236c46ad3b9a03ec07fcf1c132
-
Filesize
24KB
MD508afb75035b9a9ac996aa7881a2002c4
SHA1d88cd24c3071e7a980c9b92f08aa99582d3a3e3f
SHA25652831d2198afb6e9f624cea7bb9e7bec5b74fc22314380f4282d509e0f1c1d56
SHA512b4d9a913c05239a5bec1c446b4e13da13e1104a4361e7d46debf0f9890bec5227bad39412cacfba0d945578231133ee8776108236c46ad3b9a03ec07fcf1c132
-
Filesize
24KB
MD508afb75035b9a9ac996aa7881a2002c4
SHA1d88cd24c3071e7a980c9b92f08aa99582d3a3e3f
SHA25652831d2198afb6e9f624cea7bb9e7bec5b74fc22314380f4282d509e0f1c1d56
SHA512b4d9a913c05239a5bec1c446b4e13da13e1104a4361e7d46debf0f9890bec5227bad39412cacfba0d945578231133ee8776108236c46ad3b9a03ec07fcf1c132
-
Filesize
24KB
MD508afb75035b9a9ac996aa7881a2002c4
SHA1d88cd24c3071e7a980c9b92f08aa99582d3a3e3f
SHA25652831d2198afb6e9f624cea7bb9e7bec5b74fc22314380f4282d509e0f1c1d56
SHA512b4d9a913c05239a5bec1c446b4e13da13e1104a4361e7d46debf0f9890bec5227bad39412cacfba0d945578231133ee8776108236c46ad3b9a03ec07fcf1c132
-
Filesize
24KB
MD508afb75035b9a9ac996aa7881a2002c4
SHA1d88cd24c3071e7a980c9b92f08aa99582d3a3e3f
SHA25652831d2198afb6e9f624cea7bb9e7bec5b74fc22314380f4282d509e0f1c1d56
SHA512b4d9a913c05239a5bec1c446b4e13da13e1104a4361e7d46debf0f9890bec5227bad39412cacfba0d945578231133ee8776108236c46ad3b9a03ec07fcf1c132
-
Filesize
24KB
MD508afb75035b9a9ac996aa7881a2002c4
SHA1d88cd24c3071e7a980c9b92f08aa99582d3a3e3f
SHA25652831d2198afb6e9f624cea7bb9e7bec5b74fc22314380f4282d509e0f1c1d56
SHA512b4d9a913c05239a5bec1c446b4e13da13e1104a4361e7d46debf0f9890bec5227bad39412cacfba0d945578231133ee8776108236c46ad3b9a03ec07fcf1c132