Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 11:14
Static task
static1
Behavioral task
behavioral1
Sample
19fa48bc7ff8440268f8899534d6dc61.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
19fa48bc7ff8440268f8899534d6dc61.dll
Resource
win10v2004-20231222-en
General
-
Target
19fa48bc7ff8440268f8899534d6dc61.dll
-
Size
740KB
-
MD5
19fa48bc7ff8440268f8899534d6dc61
-
SHA1
b0b673c4028979896ba8cd6454a14bb665199fb3
-
SHA256
aeea81ffcf20e782e8dffcbedacef2e098cc8be09671825fea533a8e28a13f42
-
SHA512
9df6bb95170f9a0d9bb8331098afc565eebf6785cbc777a901926216779eb0b21c9d5541658ab46de012e872b8a7fc3eeb772eb80f4405a4ce90696280d8152d
-
SSDEEP
12288:MGEueETm04Dider2XNGQx0JFoITTKDKMXsGKEFU+abeycvyPVk2A8juwjY4Jt90:MybmH+BHx0oGm+AFUlQvyPdbb9
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Wine rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Temp = "rundll32.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\19fa48bc7ff8440268f8899534d6dc61.dll,CopyEnhMetaFileA" rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2724 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2724 rundll32.exe 2724 rundll32.exe 2724 rundll32.exe 2724 rundll32.exe 2724 rundll32.exe 2724 rundll32.exe 2724 rundll32.exe 2724 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2724 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2724 1640 rundll32.exe 14 PID 1640 wrote to memory of 2724 1640 rundll32.exe 14 PID 1640 wrote to memory of 2724 1640 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\19fa48bc7ff8440268f8899534d6dc61.dll,#11⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2724
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\19fa48bc7ff8440268f8899534d6dc61.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1640