Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 09:39
Static task
static1
Behavioral task
behavioral1
Sample
73210d4355b57bc8bdd7557bda30d16a540db0d7a8ac55677dd87cce7db60c25.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
73210d4355b57bc8bdd7557bda30d16a540db0d7a8ac55677dd87cce7db60c25.dll
Resource
win10v2004-20220812-en
General
-
Target
73210d4355b57bc8bdd7557bda30d16a540db0d7a8ac55677dd87cce7db60c25.dll
-
Size
22KB
-
MD5
a211868cba3b44f58d31da83f12e33f0
-
SHA1
b676ff2c2a0a7f7666f5199bf76ee5fc85413f42
-
SHA256
73210d4355b57bc8bdd7557bda30d16a540db0d7a8ac55677dd87cce7db60c25
-
SHA512
2b87c345c2f61ce6149b2aa09bf42b8ebbf66ce5d7b08160b7cb980e20a89626838c9814136ec49348aa68563d57c1d72c90a95728e72750fd2129dc64829e80
-
SSDEEP
384:EMm/vjh9z+dY18nQy/inBapTU7UjVfXMYLOqIySSqj5Ut1oVr4qKB:EQYFy/0aFUgOYquAc1oa
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\hosts rundll32.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = ".www-306.ibm.com www-306.ibm.comPLUGINS\\webcheck.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "PLUGINS\\webcheck.dll" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID rundll32.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 920 rundll32.exe 920 rundll32.exe 920 rundll32.exe 920 rundll32.exe 920 rundll32.exe 920 rundll32.exe 920 rundll32.exe 920 rundll32.exe 920 rundll32.exe 920 rundll32.exe 920 rundll32.exe 920 rundll32.exe 920 rundll32.exe 920 rundll32.exe 920 rundll32.exe 920 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3696 wrote to memory of 920 3696 rundll32.exe 79 PID 3696 wrote to memory of 920 3696 rundll32.exe 79 PID 3696 wrote to memory of 920 3696 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\73210d4355b57bc8bdd7557bda30d16a540db0d7a8ac55677dd87cce7db60c25.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\73210d4355b57bc8bdd7557bda30d16a540db0d7a8ac55677dd87cce7db60c25.dll,#12⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:920
-