Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 05:52

General

  • Target

    097111fb4670a74a8387396c1c076452.dll

  • Size

    297KB

  • MD5

    097111fb4670a74a8387396c1c076452

  • SHA1

    b8f248effa18e9d279c05a672a7415a0ec437e74

  • SHA256

    42f47d1a0c80203d933f141978f198ed23be7f6ed2522be641dd761d8d8c5324

  • SHA512

    17e0187d6617b52be867e731cd0e8b753caef2d99cf85ad994aae4cb9793b77862f3c02bdc6564834fb6f4697077582f6a003f7d19621decc282a80c1e439d37

  • SSDEEP

    6144:qNrDW1cNwPLvoqg0R2VhPefm0TomhHVddggfyc72ki2qT4cONI5d4wvHxE:qBy1c2obY7rhHV7ZT7TqT4rNIgMxE

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\097111fb4670a74a8387396c1c076452.dll,#1
    1⤵
    • Modifies firewall policy service
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:2356
  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\097111fb4670a74a8387396c1c076452.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2356-11-0x0000000002B70000-0x0000000002C70000-memory.dmp

    Filesize

    1024KB

  • memory/2356-14-0x0000000002B70000-0x0000000002C70000-memory.dmp

    Filesize

    1024KB

  • memory/2356-17-0x0000000002B70000-0x0000000002C70000-memory.dmp

    Filesize

    1024KB

  • memory/2356-20-0x0000000002B70000-0x0000000002C70000-memory.dmp

    Filesize

    1024KB

  • memory/2356-22-0x0000000002B70000-0x0000000002C70000-memory.dmp

    Filesize

    1024KB

  • memory/2356-28-0x0000000002B40000-0x0000000002B41000-memory.dmp

    Filesize

    4KB

  • memory/2356-27-0x0000000002B50000-0x0000000002B51000-memory.dmp

    Filesize

    4KB

  • memory/2356-26-0x0000000002B60000-0x0000000002B61000-memory.dmp

    Filesize

    4KB

  • memory/2356-25-0x0000000000180000-0x0000000000181000-memory.dmp

    Filesize

    4KB

  • memory/2356-24-0x0000000000170000-0x0000000000171000-memory.dmp

    Filesize

    4KB

  • memory/2356-23-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/2356-21-0x0000000002B70000-0x0000000002C70000-memory.dmp

    Filesize

    1024KB

  • memory/2356-19-0x0000000002B70000-0x0000000002C70000-memory.dmp

    Filesize

    1024KB

  • memory/2356-18-0x0000000002B70000-0x0000000002C70000-memory.dmp

    Filesize

    1024KB

  • memory/2356-16-0x0000000002B70000-0x0000000002C70000-memory.dmp

    Filesize

    1024KB

  • memory/2356-15-0x0000000002B70000-0x0000000002C70000-memory.dmp

    Filesize

    1024KB

  • memory/2356-13-0x0000000002B70000-0x0000000002C70000-memory.dmp

    Filesize

    1024KB

  • memory/2356-12-0x0000000002B70000-0x0000000002C70000-memory.dmp

    Filesize

    1024KB

  • memory/2356-10-0x0000000002B20000-0x0000000002B22000-memory.dmp

    Filesize

    8KB

  • memory/2356-9-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/2356-8-0x0000000002B30000-0x0000000002B31000-memory.dmp

    Filesize

    4KB

  • memory/2356-7-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/2356-6-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2356-5-0x00000000001A0000-0x00000000001A1000-memory.dmp

    Filesize

    4KB

  • memory/2356-4-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2356-3-0x0000000000300000-0x0000000000350000-memory.dmp

    Filesize

    320KB

  • memory/2356-2-0x0000000000210000-0x0000000000266000-memory.dmp

    Filesize

    344KB

  • memory/2356-1-0x0000000000210000-0x0000000000266000-memory.dmp

    Filesize

    344KB

  • memory/2356-0-0x0000000000210000-0x0000000000266000-memory.dmp

    Filesize

    344KB

  • memory/2356-29-0x0000000000210000-0x0000000000266000-memory.dmp

    Filesize

    344KB