Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
15/06/2023, 15:22
Behavioral task
behavioral1
Sample
update_dll.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
update_dll.exe
Resource
win10v2004-20230220-en
General
-
Target
update_dll.exe
-
Size
1.6MB
-
MD5
2ec19478c6e5f4ff9f373b275d1910c5
-
SHA1
01112e3d156f802059575369d039a92f95bf9025
-
SHA256
4e214aada010f0761062335b78a1bbddc879ca3bd696c7021bd3f5e8f5ab5e83
-
SHA512
3ca2eec0dcaaedd548faa363e850855479ba045d68b4be7f70592ddeb3671daa10175b21579861b764440d1cbf02dc98fcc020c217801f71d4150c0699c13b2d
-
SSDEEP
24576:y8Iog+CuyfdDCvi3c9FSgt4syKh8TVmRCE4kDXY1Ur3TfXK9QG0ILPp6MNvTxvwK:T6uyVex0c49KgVmWeMJXFVrJ3
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation update_dll.exe -
Executes dropped EXE 2 IoCs
pid Process 2504 p_update.exe 2460 p_update.exe -
Loads dropped DLL 4 IoCs
pid Process 2504 p_update.exe 2504 p_update.exe 2460 p_update.exe 2460 p_update.exe -
resource yara_rule behavioral2/memory/3176-133-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/3176-155-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/3176-170-0x0000000000400000-0x0000000000422000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3176 wrote to memory of 2504 3176 update_dll.exe 84 PID 3176 wrote to memory of 2504 3176 update_dll.exe 84 PID 3176 wrote to memory of 2504 3176 update_dll.exe 84 PID 3176 wrote to memory of 2460 3176 update_dll.exe 87 PID 3176 wrote to memory of 2460 3176 update_dll.exe 87 PID 3176 wrote to memory of 2460 3176 update_dll.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\update_dll.exe"C:\Users\Admin\AppData\Local\Temp\update_dll.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe" "shell" "update_dll.dll"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe" "shell" "update.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156B
MD5ad58457f754ff037f6ed5b56f2edc292
SHA1fcfbe7139368184246a04ba4d349a41b9724c7ea
SHA2569c77e6aaf5157b7df9941505c7c47abf9147e14fd1660b34aaf8c24d81b8b9d7
SHA5126f5029c5f9f806ad6cdb4e62435fd9a76853f429a6a1b240a13d89a7513eed3dbaee298901c93659c59f34113b4a96b24af221cd138da85043cb140b8495b264
-
Filesize
156B
MD5ad58457f754ff037f6ed5b56f2edc292
SHA1fcfbe7139368184246a04ba4d349a41b9724c7ea
SHA2569c77e6aaf5157b7df9941505c7c47abf9147e14fd1660b34aaf8c24d81b8b9d7
SHA5126f5029c5f9f806ad6cdb4e62435fd9a76853f429a6a1b240a13d89a7513eed3dbaee298901c93659c59f34113b4a96b24af221cd138da85043cb140b8495b264
-
Filesize
1.0MB
MD5f03d2e73d9f63bd3feb0d193da68577c
SHA12a4727aad2ae342498a1afb13fc2565152b8756c
SHA2563995014823782fc301a8c837a24d407697343187c97ff11aebb402ad7b08d48b
SHA512efbf81d84965bc4c01f03b97aef57712215721c84a6d3e7bc2e7204152acb8085c4526084235c7448b9bab526bf7345ff453d20e96b8b2aa5868b96770ee66dd
-
Filesize
1.0MB
MD5f03d2e73d9f63bd3feb0d193da68577c
SHA12a4727aad2ae342498a1afb13fc2565152b8756c
SHA2563995014823782fc301a8c837a24d407697343187c97ff11aebb402ad7b08d48b
SHA512efbf81d84965bc4c01f03b97aef57712215721c84a6d3e7bc2e7204152acb8085c4526084235c7448b9bab526bf7345ff453d20e96b8b2aa5868b96770ee66dd
-
Filesize
1.0MB
MD5f03d2e73d9f63bd3feb0d193da68577c
SHA12a4727aad2ae342498a1afb13fc2565152b8756c
SHA2563995014823782fc301a8c837a24d407697343187c97ff11aebb402ad7b08d48b
SHA512efbf81d84965bc4c01f03b97aef57712215721c84a6d3e7bc2e7204152acb8085c4526084235c7448b9bab526bf7345ff453d20e96b8b2aa5868b96770ee66dd
-
Filesize
1.0MB
MD5f03d2e73d9f63bd3feb0d193da68577c
SHA12a4727aad2ae342498a1afb13fc2565152b8756c
SHA2563995014823782fc301a8c837a24d407697343187c97ff11aebb402ad7b08d48b
SHA512efbf81d84965bc4c01f03b97aef57712215721c84a6d3e7bc2e7204152acb8085c4526084235c7448b9bab526bf7345ff453d20e96b8b2aa5868b96770ee66dd
-
Filesize
1.0MB
MD5f03d2e73d9f63bd3feb0d193da68577c
SHA12a4727aad2ae342498a1afb13fc2565152b8756c
SHA2563995014823782fc301a8c837a24d407697343187c97ff11aebb402ad7b08d48b
SHA512efbf81d84965bc4c01f03b97aef57712215721c84a6d3e7bc2e7204152acb8085c4526084235c7448b9bab526bf7345ff453d20e96b8b2aa5868b96770ee66dd
-
Filesize
582KB
MD54d01a17f0cf89fcfc80406728717548a
SHA1370fde5d6de249e174f1c90acfc4cdfd621005c3
SHA25606af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431
SHA512ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb
-
Filesize
582KB
MD54d01a17f0cf89fcfc80406728717548a
SHA1370fde5d6de249e174f1c90acfc4cdfd621005c3
SHA25606af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431
SHA512ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb
-
Filesize
582KB
MD54d01a17f0cf89fcfc80406728717548a
SHA1370fde5d6de249e174f1c90acfc4cdfd621005c3
SHA25606af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431
SHA512ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb
-
Filesize
582KB
MD54d01a17f0cf89fcfc80406728717548a
SHA1370fde5d6de249e174f1c90acfc4cdfd621005c3
SHA25606af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431
SHA512ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb