Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 05:12
Static task
static1
Behavioral task
behavioral1
Sample
0fb1fab0bb13ce41ad29ec2dfd6bc1f4.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
0fb1fab0bb13ce41ad29ec2dfd6bc1f4.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
0fb1fab0bb13ce41ad29ec2dfd6bc1f4.exe
-
Size
388KB
-
MD5
0fb1fab0bb13ce41ad29ec2dfd6bc1f4
-
SHA1
9d1d687556578eadaba3898e3bc075b14808976d
-
SHA256
207bcd429ff7bf98bf3b066b2a9e0b01d6c01506d3343343150952c16eb7e867
-
SHA512
d8671bbf6a569ca421edfa6b5310e1ea011710b5d2d603686bb88bc279f285a54bf73aeca60fc995d8ce471a75dfbd93953ecab557e1241ac4a272d799864c3f
-
SSDEEP
6144:LLtPzWhDFJpT9NC7rGN3bkty0Mki8787O71rkhJSammcmZE:XtrWLJxe7rGNrkty0fkhAlmvE
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 3 2296 RUNDLL32.exe 7 2296 RUNDLL32.exe -
Loads dropped DLL 1 IoCs
pid Process 2296 RUNDLL32.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe 2296 RUNDLL32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1112 wrote to memory of 2296 1112 0fb1fab0bb13ce41ad29ec2dfd6bc1f4.exe 28 PID 1112 wrote to memory of 2296 1112 0fb1fab0bb13ce41ad29ec2dfd6bc1f4.exe 28 PID 1112 wrote to memory of 2296 1112 0fb1fab0bb13ce41ad29ec2dfd6bc1f4.exe 28 PID 1112 wrote to memory of 2296 1112 0fb1fab0bb13ce41ad29ec2dfd6bc1f4.exe 28 PID 1112 wrote to memory of 2296 1112 0fb1fab0bb13ce41ad29ec2dfd6bc1f4.exe 28 PID 1112 wrote to memory of 2296 1112 0fb1fab0bb13ce41ad29ec2dfd6bc1f4.exe 28 PID 1112 wrote to memory of 2296 1112 0fb1fab0bb13ce41ad29ec2dfd6bc1f4.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fb1fab0bb13ce41ad29ec2dfd6bc1f4.exe"C:\Users\Admin\AppData\Local\Temp\0fb1fab0bb13ce41ad29ec2dfd6bc1f4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\RUNDLL32.exeRUNDLL32.exe C:\WINDOWS\Temp\HX.ini ServiceMain2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2296
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.2MB
MD55140e302010925a9eac7598f2ded57fa
SHA1f5f1d69c0f8ded37ed89b363cbd18e9864d67b0c
SHA256075097215a8aecd3a471219be03d40c97cfd93c7cbf931a3bea590188d671d17
SHA5129ad4e3f451cfddae5f67b388a1f513be5410d2c2b725518cfddedda5ff3ae21d04a427fccf2de103096c86b7c3716917c103739d853b03f756d6a67e657d51c7