Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 05:52
Behavioral task
behavioral1
Sample
097111fb4670a74a8387396c1c076452.dll
Resource
win7-20231215-en
5 signatures
150 seconds
General
-
Target
097111fb4670a74a8387396c1c076452.dll
-
Size
297KB
-
MD5
097111fb4670a74a8387396c1c076452
-
SHA1
b8f248effa18e9d279c05a672a7415a0ec437e74
-
SHA256
42f47d1a0c80203d933f141978f198ed23be7f6ed2522be641dd761d8d8c5324
-
SHA512
17e0187d6617b52be867e731cd0e8b753caef2d99cf85ad994aae4cb9793b77862f3c02bdc6564834fb6f4697077582f6a003f7d19621decc282a80c1e439d37
-
SSDEEP
6144:qNrDW1cNwPLvoqg0R2VhPefm0TomhHVddggfyc72ki2qT4cONI5d4wvHxE:qBy1c2obY7rhHV7ZT7TqT4rNIgMxE
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Use FormSuggest = "no" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FormSuggest PW Ask = "no" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FormSuggest Passwords = "no" rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2356 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1668 wrote to memory of 2356 1668 rundll32.exe 16 PID 1668 wrote to memory of 2356 1668 rundll32.exe 16 PID 1668 wrote to memory of 2356 1668 rundll32.exe 16 PID 1668 wrote to memory of 2356 1668 rundll32.exe 16 PID 1668 wrote to memory of 2356 1668 rundll32.exe 16 PID 1668 wrote to memory of 2356 1668 rundll32.exe 16 PID 1668 wrote to memory of 2356 1668 rundll32.exe 16
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\097111fb4670a74a8387396c1c076452.dll,#11⤵
- Modifies firewall policy service
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2356
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\097111fb4670a74a8387396c1c076452.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1668