Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 14:24
Static task
static1
Behavioral task
behavioral1
Sample
08c92bf3d20f09e461e12e040e873e6dd3fc892a913eb5e5f3f13ac2fcb495c4.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
08c92bf3d20f09e461e12e040e873e6dd3fc892a913eb5e5f3f13ac2fcb495c4.dll
Resource
win10v2004-20220901-en
General
-
Target
08c92bf3d20f09e461e12e040e873e6dd3fc892a913eb5e5f3f13ac2fcb495c4.dll
-
Size
145KB
-
MD5
085d007b613aa0448218713e2e5b21c8
-
SHA1
20da36e46973bbb516ebd065fc07b5090041a218
-
SHA256
08c92bf3d20f09e461e12e040e873e6dd3fc892a913eb5e5f3f13ac2fcb495c4
-
SHA512
13867eecd52f178a4f9ad35c77211b8b3447d1c035ec30a55d201e10f0e85a7ffd266034aba6ae2d719bbf0ec93d4b5c72543e9c07e814c4f06b1a657ff5f85e
-
SSDEEP
3072:eIm/CwXIp6oU7TGxWEhieYhi5U+cHeDegw23w5q0RT9:S/LIp6oU7czhiPhiu+yUk238qY
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Mvitudevibe = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\08c92bf3d20f09e461e12e040e873e6dd3fc892a913eb5e5f3f13ac2fcb495c4.dll\",Startup" rundll32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4904 rundll32.exe 4904 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4904 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3548 wrote to memory of 4904 3548 rundll32.exe 80 PID 3548 wrote to memory of 4904 3548 rundll32.exe 80 PID 3548 wrote to memory of 4904 3548 rundll32.exe 80 PID 4904 wrote to memory of 4892 4904 rundll32.exe 81 PID 4904 wrote to memory of 4892 4904 rundll32.exe 81 PID 4904 wrote to memory of 4892 4904 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\08c92bf3d20f09e461e12e040e873e6dd3fc892a913eb5e5f3f13ac2fcb495c4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\08c92bf3d20f09e461e12e040e873e6dd3fc892a913eb5e5f3f13ac2fcb495c4.dll,#12⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Modifies registry class
PID:4892
-
-