Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
29/10/2023, 23:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eraz0r.dll
Resource
win7-20231023-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
eraz0r.dll
Resource
win10v2004-20231025-en
4 signatures
150 seconds
General
-
Target
eraz0r.dll
-
Size
12.6MB
-
MD5
1a460374f370ef58c3b769d56f38b50b
-
SHA1
0dcd6b1b7db59d26bbab1ccf6930b7654477ebbe
-
SHA256
0e8e168c9bd7bf0abb03cb388e069e0050b77b2de95ca217c12e174980538b3d
-
SHA512
e2a1c37444ea8cc7c7cd20368250aee42c18160b4016d7bd4b380e41f36b3d58efa9609bf5b151b43728b6f7fad3ff65700f5b798286873c941c6067dd854961
-
SSDEEP
98304:CcDTwXlUKj57xHAe/JyS1DOlRomRQvPMaQQBtVD/EmYESD8G+JKBdK9/TToGFXob:CblUWNOlRomRQvPMa2+JB2
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 3 2976 rundll32.exe 4 2976 rundll32.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde rundll32.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2976 rundll32.exe 2976 rundll32.exe 2976 rundll32.exe 2976 rundll32.exe 2976 rundll32.exe 2976 rundll32.exe 2976 rundll32.exe 2976 rundll32.exe 2976 rundll32.exe 2976 rundll32.exe 2976 rundll32.exe 2976 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2684 notepad.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2976 rundll32.exe Token: SeShutdownPrivilege 2976 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2708 2976 rundll32.exe 29 PID 2976 wrote to memory of 2708 2976 rundll32.exe 29 PID 2976 wrote to memory of 2708 2976 rundll32.exe 29 PID 2708 wrote to memory of 2684 2708 cmd.exe 31 PID 2708 wrote to memory of 2684 2708 cmd.exe 31 PID 2708 wrote to memory of 2684 2708 cmd.exe 31 PID 2976 wrote to memory of 2684 2976 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eraz0r.dll,#11⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\system32\cmd.exe"cmd" /c "start notepad.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\system32\notepad.exenotepad.exe3⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2684
-
-