Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 11:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
69fe749b63c4d59f480ff443d2112e41.dll
Resource
win7-20231215-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
69fe749b63c4d59f480ff443d2112e41.dll
Resource
win10v2004-20231222-en
7 signatures
150 seconds
General
-
Target
69fe749b63c4d59f480ff443d2112e41.dll
-
Size
161KB
-
MD5
69fe749b63c4d59f480ff443d2112e41
-
SHA1
ebc782e0fb4994008f88e9e99375e2741f73343e
-
SHA256
6e508bb54af0305a9d707641654c1fbad951144e53dc004498299344c56f5c67
-
SHA512
bda0a5333c498ac6082bea783e86d4cd22082ea9844b064784792b5a9b7ad51f13ed5ca4d125fae769115250eaa90d48f4ba5e527cbf2949659078a97920799f
-
SSDEEP
3072:Hw8cjtD3iPjcwvGBLS8fBz02e4muPjMRDX7LiT+v5GA4/Aqdcfsw:Hu6cwvELSgO2jANiAYAUy
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0" rundll32.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rundll32.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 400 rundll32.exe 400 rundll32.exe 400 rundll32.exe 400 rundll32.exe 400 rundll32.exe 400 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 400 rundll32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3476 Explorer.EXE 3476 Explorer.EXE 3476 Explorer.EXE 3476 Explorer.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4496 wrote to memory of 400 4496 rundll32.exe 14 PID 4496 wrote to memory of 400 4496 rundll32.exe 14 PID 4496 wrote to memory of 400 4496 rundll32.exe 14 PID 400 wrote to memory of 3476 400 rundll32.exe 51 PID 400 wrote to memory of 208 400 rundll32.exe 24 PID 400 wrote to memory of 208 400 rundll32.exe 24 PID 400 wrote to memory of 208 400 rundll32.exe 24
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\69fe749b63c4d59f480ff443d2112e41.dll,#11⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Users\Admin\AppData2⤵PID:208
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\69fe749b63c4d59f480ff443d2112e41.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4496
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5020
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4732
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:3476