Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2023, 15:12
Static task
static1
Behavioral task
behavioral1
Sample
BUGSPLAT.dll
Resource
win10v2004-20230221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
INSTRUCT.lnk
Resource
win10v2004-20230220-en
3 signatures
150 seconds
General
-
Target
BUGSPLAT.dll
-
Size
265KB
-
MD5
cf36bf564fbb7d5ec4cec9b0f185f6c9
-
SHA1
8eb64670c10505322d45f6114bc9f7de0826e3a1
-
SHA256
e957326b2167fa7ccd508cbf531779a28bfce75eb2635ab81826a522979aeb98
-
SHA512
39e1f522ea424e437fe97b65ea65acb08069f6a88be61503ee75224108d105bbbec7374d8013017e78efe4e4129128316e732726cd96441d6db529556716847c
-
SSDEEP
3072:tUEmC94lAhNLdHZS/Y1s7kNf4RqWs4e32pIYNxHaaBzpodfOYFdUq20vP0X6/q:/s/YPNfEqWKG2kHaaB2kwUq20v
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 5 IoCs
flow pid Process 2 3444 rundll32.exe 6 3444 rundll32.exe 11 3444 rundll32.exe 136 3444 rundll32.exe 210 3444 rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DsDiBacks = "C:\\Windows\\System32\\rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\DsDiBacks\\BugSplatRc64.dll,InitiateDs\"" rundll32.exe