Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/12/2023, 21:31
Static task
static1
Behavioral task
behavioral1
Sample
f9881c6c96dbc5d18764ba0a11b45f91.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f9881c6c96dbc5d18764ba0a11b45f91.dll
Resource
win10v2004-20231215-en
General
-
Target
f9881c6c96dbc5d18764ba0a11b45f91.dll
-
Size
127KB
-
MD5
f9881c6c96dbc5d18764ba0a11b45f91
-
SHA1
b572ff448413b40259b48b288eb8c91e70b6186c
-
SHA256
e55c7b3a56b807f31c8d68bf8c157da9e80522a60a3e4d3be90e101ff85c9ef8
-
SHA512
4bce771d25286fce7570165e82dadf6f6dbbac1760afd7bd2f0c6262c2509b7c595b1c963b4a83314fcf5ae39779081ffdc905360351ba5fdd73e2c52fc8300c
-
SSDEEP
3072:ifC0OGQDdZJPESvZPHojlJ6+NOctcUoDthgM3X73OL5PFn0wcccccccc:MfOBvvVHojq+FoDAs30PFn0wcccccccc
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 2 1636 rundll32.exe 3 2748 rundll32.exe -
Loads dropped DLL 4 IoCs
pid Process 2748 rundll32.exe 2748 rundll32.exe 2748 rundll32.exe 2748 rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\{2AC8DCF3-2469-410F-9D17-79AF6A5E387D} = "rundll32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\{2AC8DCF3-2469-410F-9D17-79AF6A5E387D}\\5b09.dll\",DllGetClassObject secret 40558" rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1636 rundll32.exe 2748 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2496 wrote to memory of 1636 2496 rundll32.exe 28 PID 2496 wrote to memory of 1636 2496 rundll32.exe 28 PID 2496 wrote to memory of 1636 2496 rundll32.exe 28 PID 2496 wrote to memory of 1636 2496 rundll32.exe 28 PID 2496 wrote to memory of 1636 2496 rundll32.exe 28 PID 2496 wrote to memory of 1636 2496 rundll32.exe 28 PID 2496 wrote to memory of 1636 2496 rundll32.exe 28 PID 1636 wrote to memory of 2748 1636 rundll32.exe 29 PID 1636 wrote to memory of 2748 1636 rundll32.exe 29 PID 1636 wrote to memory of 2748 1636 rundll32.exe 29 PID 1636 wrote to memory of 2748 1636 rundll32.exe 29 PID 1636 wrote to memory of 2748 1636 rundll32.exe 29 PID 1636 wrote to memory of 2748 1636 rundll32.exe 29 PID 1636 wrote to memory of 2748 1636 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f9881c6c96dbc5d18764ba0a11b45f91.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f9881c6c96dbc5d18764ba0a11b45f91.dll,#12⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\{2AC8DCF3-2469-410F-9D17-79AF6A5E387D}\5b09.dll",DllGetClassObject secret 405583⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2748
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD5f9881c6c96dbc5d18764ba0a11b45f91
SHA1b572ff448413b40259b48b288eb8c91e70b6186c
SHA256e55c7b3a56b807f31c8d68bf8c157da9e80522a60a3e4d3be90e101ff85c9ef8
SHA5124bce771d25286fce7570165e82dadf6f6dbbac1760afd7bd2f0c6262c2509b7c595b1c963b4a83314fcf5ae39779081ffdc905360351ba5fdd73e2c52fc8300c