Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 13:35

General

  • Target

    1a309596c9bb24df4a97b6a2fb3967bf.dll

  • Size

    472KB

  • MD5

    1a309596c9bb24df4a97b6a2fb3967bf

  • SHA1

    75677094b4b78bbe0e07b5c35f1a371d14cd1d57

  • SHA256

    c75ce9d9dc660ddc87b315dd90ee11f70a88ac78cfd82008958f102e9a8c9bc5

  • SHA512

    6040a5314ee5db4737f07c5ad90edd8d5713a481a5718067d4695b46b1871cddd2735f3059a567cb57de733884d10eff4872f91a6d16cabaf91f1f1be4feaf1b

  • SSDEEP

    12288:gIx3n4BiTNvjrwy15K1Q4e0TsSk7h77wNpTYLb8:gIx3JNLrr5KbQ/7h7S4

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 32 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 20 IoCs
  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 47 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a309596c9bb24df4a97b6a2fb3967bf.dll,#1
    1⤵
    • Adds Run key to start application
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3248
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/a1l8.dll"
      2⤵
        PID:2040
      • C:\Windows\SysWOW64\regsvr32.exe
        C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/4f3r.dll"
        2⤵
          PID:3620
        • C:\Windows\SysWOW64\regsvr32.exe
          C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/b34o.dll"
          2⤵
            PID:4848
          • C:\Windows\SysWOW64\341d.exe
            C:\Windows\system32/341d.exe -i
            2⤵
            • Executes dropped EXE
            PID:1336
          • C:\Windows\SysWOW64\341d.exe
            C:\Windows\system32/341d.exe -s
            2⤵
            • Executes dropped EXE
            PID:648
          • C:\Windows\SysWOW64\regsvr32.exe
            C:\Windows\system32\regsvr32.exe /s "C:\Windows\system32/b34o.dll"
            2⤵
            • Loads dropped DLL
            • Installs/modifies Browser Helper Object
            • Modifies registry class
            PID:4976
          • C:\Windows\SysWOW64\regsvr32.exe
            C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/b4cb.dll"
            2⤵
              PID:2188
            • C:\Windows\SysWOW64\rundll32.exe
              C:\Windows\system32\rundll32 C:\Windows\system32/341e.dll, Always
              2⤵
              • Loads dropped DLL
              PID:4776
            • C:\Users\Admin\AppData\Local\Temp\h8nil4o8\mtv.exe
              C:\Users\Admin\AppData\Local\Temp\h8nil4o8\mtv.exe
              2⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of SetWindowsHookEx
              PID:2808
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a309596c9bb24df4a97b6a2fb3967bf.dll,#1
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:1556
          • C:\Windows\SysWOW64\341d.exe
            C:\Windows\SysWOW64\341d.exe
            1⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Writes to the Master Boot Record (MBR)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3392
            • C:\Windows\SysWOW64\rundll32.exe
              C:\Windows\system32\rundll32 C:\Windows\system32/341e.dll,Always
              2⤵
              • Loads dropped DLL
              • Writes to the Master Boot Record (MBR)
              • Drops file in System32 directory
              PID:3304
          • C:\Windows\system32\rundll32.EXE
            C:\Windows\system32\rundll32.EXE C:\Windows\system32/341e.dll,Always
            1⤵
              PID:3816

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Windows\SysWOW64\b34o.dll

              Filesize

              112KB

              MD5

              ae5fa7aed0088b1aac4d2574f7013640

              SHA1

              1ede7e6b0d63face3c4d939891501c07fa4d548a

              SHA256

              8574532ba718eab1aab24532b04233418f40df96f1ce01a825311dbd904ffa25

              SHA512

              3e242bcc244753de456840691fef2aa1d289f6c4896b8169d43f9b61d288e7d8c16dfc213fba1a230f7d39dd1b0b719d9bf17e8f876363fc69dfdb0308bfc246

            • C:\Windows\SysWOW64\b34o.dll

              Filesize

              65KB

              MD5

              cdc28331f910b4028b396dd5ad764267

              SHA1

              dccdf9d861182cfc88b816f654818f58b1762ea2

              SHA256

              e72f78c2cabc7e7afb1497a71432a8491b0f02e8f95c26c0223af170a2bd81fe

              SHA512

              6bae9c852eafecb529435b89c7c09a1478e773d52479fa3c569e0315888de3c809e021c1a0f0c624d3765533f4bfe7cf7f35dfc00b2a7e0c112033d09ae08847

            • C:\Windows\SysWOW64\b34o.dll

              Filesize

              58KB

              MD5

              73beda3cbab593835c73bff6415dd1ab

              SHA1

              64ba107fa0a06c9e302a33d05a6b35846d1e5336

              SHA256

              1097e66dec23372c5cce2f4daaee6605b4365a3444ba6b18a6f4c100e029488b

              SHA512

              7147f8a44a28d63c11cef0b517a9a52dc1a809e55b79056b4423a2a96c6bde114a6db8786fc1142ef159fe7057d993c41832eb93f7992d501eeb295209b235e3

            • C:\Windows\SysWOW64\b34o.dll

              Filesize

              93KB

              MD5

              8fccf8520fc2e791c9813b7e5b0c6813

              SHA1

              1e70a05820b67c11501974db4fa2de2ad0e77285

              SHA256

              931c84789eaafcfb0ba9bfdfa40c32f96cbd3c82b151df3c5120d0ca1f806bc4

              SHA512

              8c59fd8e56626af5b4da4e1d841376b37e1a5335c9b2a90a1e05570e9a38f92c9f94fc51ee38dfffe06142e10788bb70b004410b8098cbd03a9e848bf284a5ae