Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29/12/2023, 23:21
General
-
Target
06c6fa9558585147c13a580261fc9d18.dll
-
Size
33KB
-
MD5
06c6fa9558585147c13a580261fc9d18
-
SHA1
2181bb51dedc730da900318cbab45d37ff9be97d
-
SHA256
2b1e8c69cba6382ac3f62dc217810640eaf414830dc30c1862321a0379f091f1
-
SHA512
e88458dbd8f46e199e1f80e2443c8688f0134d28efdc0466b4de6a37d0831e4f59d7afd4bc9d79f91aa85c3c66867fc903d89af2d232cfda7798b5b2c5f8cafd
-
SSDEEP
384:CsfaKYmTz9Wmn+RDwVXtUAfTvxTP3oxX9BkLyi3BYoyxqFbHqT3CMgIwbKbu:JhNTzsm+SFTZUxtBkp3BYooIu0IdC
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Modifies registry class 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\06c6fa9558585147c13a580261fc9d18.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\06c6fa9558585147c13a580261fc9d18.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\system32\rqRIxvTM.dll,a3⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD506c6fa9558585147c13a580261fc9d18
SHA12181bb51dedc730da900318cbab45d37ff9be97d
SHA2562b1e8c69cba6382ac3f62dc217810640eaf414830dc30c1862321a0379f091f1
SHA512e88458dbd8f46e199e1f80e2443c8688f0134d28efdc0466b4de6a37d0831e4f59d7afd4bc9d79f91aa85c3c66867fc903d89af2d232cfda7798b5b2c5f8cafd
-
Filesize
64KB
-
Filesize
20KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
20KB
-
Filesize
64KB
-
Filesize
20KB
-
Filesize
64KB
-
Filesize
20KB