Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
11s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 14:24
Static task
static1
Behavioral task
behavioral1
Sample
08c92bf3d20f09e461e12e040e873e6dd3fc892a913eb5e5f3f13ac2fcb495c4.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
08c92bf3d20f09e461e12e040e873e6dd3fc892a913eb5e5f3f13ac2fcb495c4.dll
Resource
win10v2004-20220901-en
General
-
Target
08c92bf3d20f09e461e12e040e873e6dd3fc892a913eb5e5f3f13ac2fcb495c4.dll
-
Size
145KB
-
MD5
085d007b613aa0448218713e2e5b21c8
-
SHA1
20da36e46973bbb516ebd065fc07b5090041a218
-
SHA256
08c92bf3d20f09e461e12e040e873e6dd3fc892a913eb5e5f3f13ac2fcb495c4
-
SHA512
13867eecd52f178a4f9ad35c77211b8b3447d1c035ec30a55d201e10f0e85a7ffd266034aba6ae2d719bbf0ec93d4b5c72543e9c07e814c4f06b1a657ff5f85e
-
SSDEEP
3072:eIm/CwXIp6oU7TGxWEhieYhi5U+cHeDegw23w5q0RT9:S/LIp6oU7czhiPhiu+yUk238qY
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cjexiyuwamoxob = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\08c92bf3d20f09e461e12e040e873e6dd3fc892a913eb5e5f3f13ac2fcb495c4.dll\",Startup" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1804 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1804 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1016 wrote to memory of 1804 1016 rundll32.exe 27 PID 1016 wrote to memory of 1804 1016 rundll32.exe 27 PID 1016 wrote to memory of 1804 1016 rundll32.exe 27 PID 1016 wrote to memory of 1804 1016 rundll32.exe 27 PID 1016 wrote to memory of 1804 1016 rundll32.exe 27 PID 1016 wrote to memory of 1804 1016 rundll32.exe 27 PID 1016 wrote to memory of 1804 1016 rundll32.exe 27 PID 1804 wrote to memory of 1768 1804 rundll32.exe 28 PID 1804 wrote to memory of 1768 1804 rundll32.exe 28 PID 1804 wrote to memory of 1768 1804 rundll32.exe 28 PID 1804 wrote to memory of 1768 1804 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\08c92bf3d20f09e461e12e040e873e6dd3fc892a913eb5e5f3f13ac2fcb495c4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\08c92bf3d20f09e461e12e040e873e6dd3fc892a913eb5e5f3f13ac2fcb495c4.dll,#12⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:1768
-
-