Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
277s -
max time network
361s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
07/12/2022, 01:45
Static task
static1
Behavioral task
behavioral1
Sample
ce033e7122990b1c13c24241080daabafa824c7fea207f69f7b20879373c8488.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ce033e7122990b1c13c24241080daabafa824c7fea207f69f7b20879373c8488.dll
Resource
win10v2004-20220812-en
General
-
Target
ce033e7122990b1c13c24241080daabafa824c7fea207f69f7b20879373c8488.dll
-
Size
439KB
-
MD5
6ac19eb52854a4c54f1d15a47006ca40
-
SHA1
2c047a3096d2eae93f10e81b305db188373dac5f
-
SHA256
ce033e7122990b1c13c24241080daabafa824c7fea207f69f7b20879373c8488
-
SHA512
ea881065669ece3200ea0db646f6726bebcfa014320b96da07849c74c19a998250ab1733533e4e33038f804f74358d5a4690e172bbc469c9f74c10b925de1449
-
SSDEEP
12288:3ci5MfnJSDaSwr3qH+w6NAxcLAcRdAP8QLY7/1C7Jz:3chwDaSs3k+w6ocLAcvAP9YT1k
Malware Config
Signatures
-
Blocklisted process makes network request 9 IoCs
flow pid Process 7 940 rundll32.exe 9 940 rundll32.exe 10 940 rundll32.exe 11 940 rundll32.exe 12 940 rundll32.exe 13 940 rundll32.exe 14 940 rundll32.exe 15 940 rundll32.exe 16 940 rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\-49492341 rundll32.exe File created C:\Windows\SysWOW64\29ca rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 320 wrote to memory of 940 320 rundll32.exe 27 PID 320 wrote to memory of 940 320 rundll32.exe 27 PID 320 wrote to memory of 940 320 rundll32.exe 27 PID 320 wrote to memory of 940 320 rundll32.exe 27 PID 320 wrote to memory of 940 320 rundll32.exe 27 PID 320 wrote to memory of 940 320 rundll32.exe 27 PID 320 wrote to memory of 940 320 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ce033e7122990b1c13c24241080daabafa824c7fea207f69f7b20879373c8488.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ce033e7122990b1c13c24241080daabafa824c7fea207f69f7b20879373c8488.dll,#12⤵
- Blocklisted process makes network request
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
PID:940
-