Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
73s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2022, 10:26
Static task
static1
Behavioral task
behavioral1
Sample
c28e85cd2d94078ebc964dc23d59ab50b08f6bed3f3bc62cb04845b52429dad6.dll
Resource
win7-20221111-en
General
-
Target
c28e85cd2d94078ebc964dc23d59ab50b08f6bed3f3bc62cb04845b52429dad6.dll
-
Size
1.4MB
-
MD5
2a68a3cf62c3e481d9fea10b44427d90
-
SHA1
fbbb27343f9a1c64c981d508b2196b5330ab83b9
-
SHA256
c28e85cd2d94078ebc964dc23d59ab50b08f6bed3f3bc62cb04845b52429dad6
-
SHA512
51bb2b0b95423f4490008edd39ded18f69e284368ff1dfd0b796b61f0508479ebd1c5b4664045b4c9a6e16d7a6bf3018888425fe868dfbfd414a3136c822ad0b
-
SSDEEP
24576:I05V+F+mYxMiKUvDlRopK0wDDGB+YbqT4euiXaCVyqE0iDuY:I0/V865RL0wvGBxK4VDu
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3628 rundll32Srv.exe 1476 DesktopLayer.exe -
resource yara_rule behavioral2/files/0x0004000000022e00-134.dat upx behavioral2/files/0x0004000000022e00-135.dat upx behavioral2/files/0x0004000000022e01-138.dat upx behavioral2/files/0x0004000000022e01-137.dat upx behavioral2/memory/3628-139-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1476-140-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32Srv.exe rundll32.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\pxFA53.tmp rundll32Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe rundll32Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe rundll32Srv.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3304 3736 WerFault.exe 83 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3242518663" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3253301314" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3242518663" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30997907" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375791349" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30997907" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{ECC12106-6986-11ED-A0EE-7A46CE8ECE48} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30997907" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1476 DesktopLayer.exe 1476 DesktopLayer.exe 1476 DesktopLayer.exe 1476 DesktopLayer.exe 1476 DesktopLayer.exe 1476 DesktopLayer.exe 1476 DesktopLayer.exe 1476 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3076 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3076 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3076 iexplore.exe 3076 iexplore.exe 1904 IEXPLORE.EXE 1904 IEXPLORE.EXE 1904 IEXPLORE.EXE 1904 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2252 wrote to memory of 3736 2252 rundll32.exe 83 PID 2252 wrote to memory of 3736 2252 rundll32.exe 83 PID 2252 wrote to memory of 3736 2252 rundll32.exe 83 PID 3736 wrote to memory of 3628 3736 rundll32.exe 84 PID 3736 wrote to memory of 3628 3736 rundll32.exe 84 PID 3736 wrote to memory of 3628 3736 rundll32.exe 84 PID 3628 wrote to memory of 1476 3628 rundll32Srv.exe 85 PID 3628 wrote to memory of 1476 3628 rundll32Srv.exe 85 PID 3628 wrote to memory of 1476 3628 rundll32Srv.exe 85 PID 1476 wrote to memory of 3076 1476 DesktopLayer.exe 87 PID 1476 wrote to memory of 3076 1476 DesktopLayer.exe 87 PID 3076 wrote to memory of 1904 3076 iexplore.exe 89 PID 3076 wrote to memory of 1904 3076 iexplore.exe 89 PID 3076 wrote to memory of 1904 3076 iexplore.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c28e85cd2d94078ebc964dc23d59ab50b08f6bed3f3bc62cb04845b52429dad6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c28e85cd2d94078ebc964dc23d59ab50b08f6bed3f3bc62cb04845b52429dad6.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\rundll32Srv.exeC:\Windows\SysWOW64\rundll32Srv.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3076 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1904
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 6283⤵
- Program crash
PID:3304
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3736 -ip 37361⤵PID:3780
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD542bacbdf56184c2fa5fe6770857e2c2d
SHA1521a63ee9ce2f615eda692c382b16fc1b1d57cac
SHA256d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0
SHA5120ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71
-
Filesize
55KB
MD542bacbdf56184c2fa5fe6770857e2c2d
SHA1521a63ee9ce2f615eda692c382b16fc1b1d57cac
SHA256d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0
SHA5120ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5cb295ed32b0acd9eac87bcc961fb315a
SHA1a580f2d38c9d1611e25b6aaa3d79b54eb34d3ebe
SHA256980abeaa872503211925db8acf8bdcdff0bc3c6deb2182fd698f6a444d2625be
SHA512974f48bdfb8ea90a49cfa25cacc98c9a145702f4e4967dd6ffddd5eaee6144189499682e80b342708e04f812006314b04e5715492170d0f63c7b0530e9cd399a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD559d5552dc1d2a1e5f05ef20348e157fa
SHA141d61c267a2b71cba13c1a3a7d3543abd7998b61
SHA256f253c244d1d09493cc058f68b88de5ad860498d2b985cfd8a69179fa985c6f41
SHA512c3d15d81c1997dc504448383d47aaf8be4779a082333e20b7a03a88db1c846a4fea5c8ae15214f55a1da568b10e0de48e7adc8b1559f8fb71dd646363fa157cc
-
Filesize
55KB
MD542bacbdf56184c2fa5fe6770857e2c2d
SHA1521a63ee9ce2f615eda692c382b16fc1b1d57cac
SHA256d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0
SHA5120ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71
-
Filesize
55KB
MD542bacbdf56184c2fa5fe6770857e2c2d
SHA1521a63ee9ce2f615eda692c382b16fc1b1d57cac
SHA256d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0
SHA5120ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71