Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
9s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 06:51
Static task
static1
Behavioral task
behavioral1
Sample
64573930ce1653e495ac7b4272113003e2d18badfdd0892c58f427bbac44820c.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
64573930ce1653e495ac7b4272113003e2d18badfdd0892c58f427bbac44820c.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
64573930ce1653e495ac7b4272113003e2d18badfdd0892c58f427bbac44820c.dll
-
Size
27KB
-
MD5
13b19c443e6994ffdf287e3a6b591370
-
SHA1
cacad7c09953913152af3ded4dad2d42075c8b8a
-
SHA256
64573930ce1653e495ac7b4272113003e2d18badfdd0892c58f427bbac44820c
-
SHA512
db916b6a3cac5fdd87fb6fc2c48c233ca3941610d5ac2a6bdc9610e625463e730ed3cf938a4acc31d2dfc1da86b57c34f8eedfd6ba7f235ececdcee2148f944f
-
SSDEEP
384:1/yASy0m2N4tlJQNPi20Q/IdPc8zuPWSXabDOJBpbmXwkIvuwHjCYe:S0lJwPi5Q/IVZu+kVmf2e
Malware Config
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 1 1212 rundll32.exe 2 1212 rundll32.exe 3 1212 rundll32.exe 4 1212 rundll32.exe 5 1212 rundll32.exe 6 1212 rundll32.exe 7 1212 rundll32.exe 8 1212 rundll32.exe 9 1212 rundll32.exe 10 1212 rundll32.exe 11 1212 rundll32.exe 12 1212 rundll32.exe 13 1212 rundll32.exe 14 1212 rundll32.exe 15 1212 rundll32.exe 16 1212 rundll32.exe 17 1212 rundll32.exe 18 1212 rundll32.exe 19 1212 rundll32.exe 20 1212 rundll32.exe 21 1212 rundll32.exe 22 1212 rundll32.exe 23 1212 rundll32.exe 24 1212 rundll32.exe 25 1212 rundll32.exe 26 1212 rundll32.exe 27 1212 rundll32.exe 28 1212 rundll32.exe 29 1212 rundll32.exe 30 1212 rundll32.exe 31 1212 rundll32.exe 32 1212 rundll32.exe 33 1212 rundll32.exe 34 1212 rundll32.exe 35 1212 rundll32.exe 36 1212 rundll32.exe 37 1212 rundll32.exe 38 1212 rundll32.exe 39 1212 rundll32.exe 40 1212 rundll32.exe 41 1212 rundll32.exe 42 1212 rundll32.exe 43 1212 rundll32.exe 44 1212 rundll32.exe 45 1212 rundll32.exe 46 1212 rundll32.exe 47 1212 rundll32.exe 48 1212 rundll32.exe 49 1212 rundll32.exe 50 1212 rundll32.exe 51 1212 rundll32.exe 52 1212 rundll32.exe 53 1212 rundll32.exe 54 1212 rundll32.exe 55 1212 rundll32.exe 56 1212 rundll32.exe 57 1212 rundll32.exe 58 1212 rundll32.exe 59 1212 rundll32.exe 60 1212 rundll32.exe 61 1212 rundll32.exe 62 1212 rundll32.exe 63 1212 rundll32.exe 64 1212 rundll32.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\4287860077\ImagePath = "\\systemroot\\4287860077" rundll32.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1212 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 1212 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1004 wrote to memory of 1212 1004 rundll32.exe 28 PID 1004 wrote to memory of 1212 1004 rundll32.exe 28 PID 1004 wrote to memory of 1212 1004 rundll32.exe 28 PID 1004 wrote to memory of 1212 1004 rundll32.exe 28 PID 1004 wrote to memory of 1212 1004 rundll32.exe 28 PID 1004 wrote to memory of 1212 1004 rundll32.exe 28 PID 1004 wrote to memory of 1212 1004 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\64573930ce1653e495ac7b4272113003e2d18badfdd0892c58f427bbac44820c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\64573930ce1653e495ac7b4272113003e2d18badfdd0892c58f427bbac44820c.dll,#12⤵
- Blocklisted process makes network request
- Sets service image path in registry
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1212
-