Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
31/01/2023, 18:30
230131-w5xvqahf27 1031/01/2023, 18:16
230131-wwy2eshe77 331/01/2023, 17:51
230131-wfchgsbd2v 331/01/2023, 17:49
230131-wd521shd85 3Analysis
-
max time kernel
82s -
max time network
39s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
31/01/2023, 17:49
Static task
static1
Behavioral task
behavioral1
Sample
Qakbot.dll
Resource
win7-20220812-en
windows7-x64
7 signatures
600 seconds
Behavioral task
behavioral2
Sample
Qakbot.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
2 signatures
600 seconds
General
-
Target
Qakbot.dll
-
Size
713KB
-
MD5
ea01b105c2c1bb90559bea2cd3df26fe
-
SHA1
cf73e2502f7976288857d81adf812b1b0c7c55d0
-
SHA256
4a990b2e48bc3a48a93ec155feb21d79201f6bf8b248ecd16367dc14bd2bce75
-
SHA512
698e72e18a4312b128989068a79869ec58a3e234e4af0516c98ccd0b839397e7bc1e534f316aa97f360dee2f9ce1bb119519010bb4566374ed333325eb84df5c
-
SSDEEP
12288:9qwFxm3G6H4RyuHbR1MxnuTV/iV1SdURA8s2Q5Qp:QwFxm3G6H4IuHbR1MxnuTV/iV1QTQ
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1272 960 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1364 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1364 taskmgr.exe -
Suspicious use of FindShellTrayWindow 56 IoCs
pid Process 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe -
Suspicious use of SendNotifyMessage 56 IoCs
pid Process 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe 1364 taskmgr.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1144 wrote to memory of 960 1144 rundll32.exe 27 PID 1144 wrote to memory of 960 1144 rundll32.exe 27 PID 1144 wrote to memory of 960 1144 rundll32.exe 27 PID 1144 wrote to memory of 960 1144 rundll32.exe 27 PID 1144 wrote to memory of 960 1144 rundll32.exe 27 PID 1144 wrote to memory of 960 1144 rundll32.exe 27 PID 1144 wrote to memory of 960 1144 rundll32.exe 27 PID 960 wrote to memory of 1272 960 rundll32.exe 28 PID 960 wrote to memory of 1272 960 rundll32.exe 28 PID 960 wrote to memory of 1272 960 rundll32.exe 28 PID 960 wrote to memory of 1272 960 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Qakbot.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Qakbot.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 2283⤵
- Program crash
PID:1272
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1364