Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 05:49
Static task
static1
Behavioral task
behavioral1
Sample
ea20057b28e9ec9541c7b11904c3023e908120376500148263b25e9883d7b9eb.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ea20057b28e9ec9541c7b11904c3023e908120376500148263b25e9883d7b9eb.dll
Resource
win10v2004-20221111-en
General
-
Target
ea20057b28e9ec9541c7b11904c3023e908120376500148263b25e9883d7b9eb.dll
-
Size
84KB
-
MD5
a02d0b5ce100ae70166d059779fc0cbe
-
SHA1
086790633091498460628a7d09065b997f0d8f1a
-
SHA256
ea20057b28e9ec9541c7b11904c3023e908120376500148263b25e9883d7b9eb
-
SHA512
297c1011d347ef1ca6c2190fce1d88d764f341a360162592783170b32555c5280d14177953535876f78e795ac774f14c623726f6a972ae59c37ff4c40b805e63
-
SSDEEP
1536:XI6MkQBrH/00X4KNp/Itjz2JlrwTTPNoDwxcC6jHFv9FlF9BFfYRKYqgnqR:YKQBrHV1NxItPxO0xL6jHL/F9BRqKY5a
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1112 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1768 wrote to memory of 1112 1768 rundll32.exe 27 PID 1768 wrote to memory of 1112 1768 rundll32.exe 27 PID 1768 wrote to memory of 1112 1768 rundll32.exe 27 PID 1768 wrote to memory of 1112 1768 rundll32.exe 27 PID 1768 wrote to memory of 1112 1768 rundll32.exe 27 PID 1768 wrote to memory of 1112 1768 rundll32.exe 27 PID 1768 wrote to memory of 1112 1768 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ea20057b28e9ec9541c7b11904c3023e908120376500148263b25e9883d7b9eb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ea20057b28e9ec9541c7b11904c3023e908120376500148263b25e9883d7b9eb.dll,#12⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:1112
-