Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    271s
  • max time network
    352s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 10:06

General

  • Target

    a51a726f13cb88cdb9e829d826cdcd542ce842898c6496831d6229a2b45530ec.dll

  • Size

    173KB

  • MD5

    79e0c98ede7fd1e21dd10a80de5454e0

  • SHA1

    3c864994347bae76ebede61e91cc4b6047c484f1

  • SHA256

    a51a726f13cb88cdb9e829d826cdcd542ce842898c6496831d6229a2b45530ec

  • SHA512

    6fc29a7c8464953a33cb92b5b161d5944fcb5db4b9a92b4508a416edc92c2e19e1951d11963ea04bd9ebc031825904466a1f8cf30b321f48f71d840cbce1a5b6

  • SSDEEP

    3072:foKMQavV343xtXDPM0z0j52+BnSL4NcR7aftNSFT5J9ZUSiq79wjgkvnfNRHD2:6QavB43xtTPj+JSL4qRWNiZUSiq7WMkf

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\a51a726f13cb88cdb9e829d826cdcd542ce842898c6496831d6229a2b45530ec.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:516
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\a51a726f13cb88cdb9e829d826cdcd542ce842898c6496831d6229a2b45530ec.dll,#1
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetWindowsHookEx
      PID:1380
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1304 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1640
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1304 CREDAT:275461 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1072
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1304 CREDAT:406535 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:924

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1380-55-0x0000000076391000-0x0000000076393000-memory.dmp

    Filesize

    8KB

  • memory/1380-56-0x0000000000130000-0x0000000000145000-memory.dmp

    Filesize

    84KB

  • memory/1380-57-0x0000000000160000-0x000000000018E000-memory.dmp

    Filesize

    184KB

  • memory/1380-61-0x0000000000130000-0x0000000000145000-memory.dmp

    Filesize

    84KB