Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

3

libcurl.dll

windows7-x64

1

libcurl.dll

windows10-2004-x64

1

Resubmissions

19/12/2023, 13:17

231219-qjq76acbfm 3

Analysis

  • max time kernel
    52s
  • max time network
    61s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/12/2023, 13:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    libcurl.dll

  • Size

    357KB

  • MD5

    94f86810eb79615f97d72d8ad02898e1

  • SHA1

    e7049e4f0d1e119401b38b9dcbf3ca9d6e4658f8

  • SHA256

    3f8da5d739115b83063d1b10675a2c0d3ed0e9df1f3a919da35915351c437c12

  • SHA512

    42ed49c66b823bbd5115bdf5395dc79d70c6bcc7313fbc1ce08280a0a2b77bea6fbddddde79e32d5bbf2f2ab4b72d7d0a4eccfc3cb9f08f067ceace2527f19d8

  • SSDEEP

    6144:O8I388llM52ef90EyNjVPS7ZOAGB+Glo+PpfC3c1Ch38lzqRj+h:lL8llA0EMVkUl/51Chwz84

Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcurl.dll,#1
    1⤵
      PID:1412
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3312

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads