Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    35s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 21:53

General

  • Target

    3eeb9eeb9449abfb063703ea53f5b5921ae6f3ce542bb5cf187e8133b79e864c.dll

  • Size

    103KB

  • MD5

    59b81f67645b876427e5f25ebc12a2c0

  • SHA1

    c39741521c3303b0ebc3b704734f223c008781cc

  • SHA256

    3eeb9eeb9449abfb063703ea53f5b5921ae6f3ce542bb5cf187e8133b79e864c

  • SHA512

    6f84c91ae7886680c185ee1b117ae5ce1385d156b97a188097e2a8fccc62bb47e2741a8aea420d9208620e983416a36dec64237aaf1c95378b035a076aceee30

  • SSDEEP

    1536:wmD6BS7LL1edo9yHSmxt4B4LCXivshX5tlL:wVBon1eWyHS2uBKvOJ

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eeb9eeb9449abfb063703ea53f5b5921ae6f3ce542bb5cf187e8133b79e864c.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:944
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eeb9eeb9449abfb063703ea53f5b5921ae6f3ce542bb5cf187e8133b79e864c.dll,#1
      2⤵
      • Loads dropped DLL
      • Enumerates connected drives
      • Suspicious use of WriteProcessMemory
      PID:672
      • C:\Users\Admin\AppData\Local\Temp\hrlAC76.tmp
        C:\Users\Admin\AppData\Local\Temp\hrlAC76.tmp
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:684
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 112
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1268

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hrlAC76.tmp

    Filesize

    95KB

    MD5

    83109cdd79db555786a11e0c503a5412

    SHA1

    3ee0cca5c8e0d993722071cb6a8e3f1c38b60831

    SHA256

    393f72306c60d0de25c5557968d09e46e78db619d9edfa4d81129101a4fb3368

    SHA512

    3fee1b9921faaafe3a9fe22defaedd84a40027140470dbf8f3306a0b0080282689060a0e32829bac6a7063cba5d23453609ccacb259ec01b98d4d6a28648fe31

  • \Users\Admin\AppData\Local\Temp\hrlAC76.tmp

    Filesize

    95KB

    MD5

    83109cdd79db555786a11e0c503a5412

    SHA1

    3ee0cca5c8e0d993722071cb6a8e3f1c38b60831

    SHA256

    393f72306c60d0de25c5557968d09e46e78db619d9edfa4d81129101a4fb3368

    SHA512

    3fee1b9921faaafe3a9fe22defaedd84a40027140470dbf8f3306a0b0080282689060a0e32829bac6a7063cba5d23453609ccacb259ec01b98d4d6a28648fe31

  • \Users\Admin\AppData\Local\Temp\hrlAC76.tmp

    Filesize

    95KB

    MD5

    83109cdd79db555786a11e0c503a5412

    SHA1

    3ee0cca5c8e0d993722071cb6a8e3f1c38b60831

    SHA256

    393f72306c60d0de25c5557968d09e46e78db619d9edfa4d81129101a4fb3368

    SHA512

    3fee1b9921faaafe3a9fe22defaedd84a40027140470dbf8f3306a0b0080282689060a0e32829bac6a7063cba5d23453609ccacb259ec01b98d4d6a28648fe31

  • \Users\Admin\AppData\Local\Temp\hrlAC76.tmp

    Filesize

    95KB

    MD5

    83109cdd79db555786a11e0c503a5412

    SHA1

    3ee0cca5c8e0d993722071cb6a8e3f1c38b60831

    SHA256

    393f72306c60d0de25c5557968d09e46e78db619d9edfa4d81129101a4fb3368

    SHA512

    3fee1b9921faaafe3a9fe22defaedd84a40027140470dbf8f3306a0b0080282689060a0e32829bac6a7063cba5d23453609ccacb259ec01b98d4d6a28648fe31

  • \Users\Admin\AppData\Local\Temp\hrlAC76.tmp

    Filesize

    95KB

    MD5

    83109cdd79db555786a11e0c503a5412

    SHA1

    3ee0cca5c8e0d993722071cb6a8e3f1c38b60831

    SHA256

    393f72306c60d0de25c5557968d09e46e78db619d9edfa4d81129101a4fb3368

    SHA512

    3fee1b9921faaafe3a9fe22defaedd84a40027140470dbf8f3306a0b0080282689060a0e32829bac6a7063cba5d23453609ccacb259ec01b98d4d6a28648fe31

  • \Users\Admin\AppData\Local\Temp\hrlAC76.tmp

    Filesize

    95KB

    MD5

    83109cdd79db555786a11e0c503a5412

    SHA1

    3ee0cca5c8e0d993722071cb6a8e3f1c38b60831

    SHA256

    393f72306c60d0de25c5557968d09e46e78db619d9edfa4d81129101a4fb3368

    SHA512

    3fee1b9921faaafe3a9fe22defaedd84a40027140470dbf8f3306a0b0080282689060a0e32829bac6a7063cba5d23453609ccacb259ec01b98d4d6a28648fe31

  • \Users\Admin\AppData\Local\Temp\hrlAC76.tmp

    Filesize

    95KB

    MD5

    83109cdd79db555786a11e0c503a5412

    SHA1

    3ee0cca5c8e0d993722071cb6a8e3f1c38b60831

    SHA256

    393f72306c60d0de25c5557968d09e46e78db619d9edfa4d81129101a4fb3368

    SHA512

    3fee1b9921faaafe3a9fe22defaedd84a40027140470dbf8f3306a0b0080282689060a0e32829bac6a7063cba5d23453609ccacb259ec01b98d4d6a28648fe31

  • memory/672-64-0x0000000000160000-0x000000000017C000-memory.dmp

    Filesize

    112KB

  • memory/672-55-0x00000000761E1000-0x00000000761E3000-memory.dmp

    Filesize

    8KB

  • memory/684-65-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB