Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 22:22
Static task
static1
Behavioral task
behavioral1
Sample
85e1ecc1992015d6f946a183ceaaf9e022fbcc36bdb2a7fa13bf2337f9c60c38.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
85e1ecc1992015d6f946a183ceaaf9e022fbcc36bdb2a7fa13bf2337f9c60c38.dll
Resource
win10v2004-20220812-en
General
-
Target
85e1ecc1992015d6f946a183ceaaf9e022fbcc36bdb2a7fa13bf2337f9c60c38.dll
-
Size
998KB
-
MD5
fd4fa44ae6b548123f7b136fb1811be9
-
SHA1
426fe9207035c449b6fbd9e25bfeed5550e2bf94
-
SHA256
85e1ecc1992015d6f946a183ceaaf9e022fbcc36bdb2a7fa13bf2337f9c60c38
-
SHA512
457ba7a8acb1c0fd28bf143aa548dc8fb918d7edcf44ef83946e63a7ef95d3ba6a85caa49f80028e9f43522b8f62699c2af9794909e63f4391d95607cc70208f
-
SSDEEP
24576:UeVlmJUzOLgGGDu/DtJvTyHOeF/l43kdz5oy1p:UriSLgPDQDtJvaOeY3kdz5
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Wine rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5092 wrote to memory of 1656 5092 rundll32.exe 79 PID 5092 wrote to memory of 1656 5092 rundll32.exe 79 PID 5092 wrote to memory of 1656 5092 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\85e1ecc1992015d6f946a183ceaaf9e022fbcc36bdb2a7fa13bf2337f9c60c38.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\85e1ecc1992015d6f946a183ceaaf9e022fbcc36bdb2a7fa13bf2337f9c60c38.dll,#12⤵
- Identifies Wine through registry keys
PID:1656
-