Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 19:34
Static task
static1
Behavioral task
behavioral1
Sample
adddfe33c6f6b1201aeac2907d07f777502398991c858b959d8309df337d2c0f.dll
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
adddfe33c6f6b1201aeac2907d07f777502398991c858b959d8309df337d2c0f.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
adddfe33c6f6b1201aeac2907d07f777502398991c858b959d8309df337d2c0f.dll
-
Size
23KB
-
MD5
59856d1926c9f4846cc4efeac492acae
-
SHA1
1cdc90969c610d9bf036a91e7ebfb878915f2664
-
SHA256
adddfe33c6f6b1201aeac2907d07f777502398991c858b959d8309df337d2c0f
-
SHA512
e40097ec7dd46d404eb333d2d99d74a42a5cf1dd35bd5e4656d8ab4891bd54e7b47d435b18f21ed9108ee61ae9d597bb3e8fcc48088dab78a264e45a53dc784e
-
SSDEEP
384:pYIp8RA0nHWX2I/LuE1iOLSgHu0OtjryMu2iFoNTlpRSIUtLDRw9s:p5qAEQuE1XLSgHV2jryMCmBpnYL12
Score
8/10
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "%SystemRoot%\\System32\\winmide32.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "%SystemRoot%\\System32\\winmide32.dll" svchost.exe -
Sets service image path in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" svchost.exe -
Loads dropped DLL 1 IoCs
pid Process 4696 svchost.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\winmide32.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\winmide32.dll rundll32.exe File created C:\Windows\SysWOW64\wins\wins.lib rundll32.exe File created C:\Windows\SysWOW64\winmide32.dll svchost.exe File created C:\Windows\SysWOW64\wins\wins.lib svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe 4696 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4696 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe Token: SeDebugPrivilege 4696 svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1144 wrote to memory of 4780 1144 rundll32.exe 80 PID 1144 wrote to memory of 4780 1144 rundll32.exe 80 PID 1144 wrote to memory of 4780 1144 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\adddfe33c6f6b1201aeac2907d07f777502398991c858b959d8309df337d2c0f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\adddfe33c6f6b1201aeac2907d07f777502398991c858b959d8309df337d2c0f.dll,#12⤵
- Sets DLL path for service in the registry
- Sets service image path in registry
- Drops file in System32 directory
PID:4780
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4696
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD559856d1926c9f4846cc4efeac492acae
SHA11cdc90969c610d9bf036a91e7ebfb878915f2664
SHA256adddfe33c6f6b1201aeac2907d07f777502398991c858b959d8309df337d2c0f
SHA512e40097ec7dd46d404eb333d2d99d74a42a5cf1dd35bd5e4656d8ab4891bd54e7b47d435b18f21ed9108ee61ae9d597bb3e8fcc48088dab78a264e45a53dc784e
-
Filesize
23KB
MD559856d1926c9f4846cc4efeac492acae
SHA11cdc90969c610d9bf036a91e7ebfb878915f2664
SHA256adddfe33c6f6b1201aeac2907d07f777502398991c858b959d8309df337d2c0f
SHA512e40097ec7dd46d404eb333d2d99d74a42a5cf1dd35bd5e4656d8ab4891bd54e7b47d435b18f21ed9108ee61ae9d597bb3e8fcc48088dab78a264e45a53dc784e