Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 03:40
Static task
static1
Behavioral task
behavioral1
Sample
26b3be28bd80be9619b28fb0b9245575.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
26b3be28bd80be9619b28fb0b9245575.dll
Resource
win10v2004-20231222-en
General
-
Target
26b3be28bd80be9619b28fb0b9245575.dll
-
Size
236KB
-
MD5
26b3be28bd80be9619b28fb0b9245575
-
SHA1
462baecbfc4056d23bf2ab75f7797b6e4266b25b
-
SHA256
b7e9ca106429a04c13dca37a1d43114199a6a1606e689f924760e6987d44c20e
-
SHA512
743e5c0150d89e6685c4f9499f4f637a832c5363bc1ce36dfe49c63fac1719cce282c2ba0b7619a8a63806bff070210456e90ee549eb8b3d838245d46bdd9361
-
SSDEEP
1536:Iguo2K86vta10RJQYPIHL+D5IWhxRh/Ci4ucg3/+k5ltr+DRPG8Gz7wk+cQvMx:Go256vS0RJAL+lHPKi40+66iwkD0G
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\wmqbu = "{ceaf02fb-4627-9b7c-5738-46278a7302ad}" rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 1956 rundll32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rhlwp.dll rundll32.exe File created C:\Windows\SysWOW64\jzdoh.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\jzdoh.dll rundll32.exe File created C:\Windows\SysWOW64\rhlwp.dll rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ceaf02fb-4627-9b7c-5738-46278a7302ad}\ rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ceaf02fb-4627-9b7c-5738-46278a7302ad}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ceaf02fb-4627-9b7c-5738-46278a7302ad}\InprocServer32\ = "C:\\Windows\\SysWow64\\rhlwp.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ceaf02fb-4627-9b7c-5738-46278a7302ad}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ceaf02fb-4627-9b7c-5738-46278a7302ad} rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1956 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1956 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1956 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1764 wrote to memory of 1956 1764 rundll32.exe 28 PID 1764 wrote to memory of 1956 1764 rundll32.exe 28 PID 1764 wrote to memory of 1956 1764 rundll32.exe 28 PID 1764 wrote to memory of 1956 1764 rundll32.exe 28 PID 1764 wrote to memory of 1956 1764 rundll32.exe 28 PID 1764 wrote to memory of 1956 1764 rundll32.exe 28 PID 1764 wrote to memory of 1956 1764 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\26b3be28bd80be9619b28fb0b9245575.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\26b3be28bd80be9619b28fb0b9245575.dll,#12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD584d57279a4265c83e191956672971353
SHA1c1c22773e37ab44a59ca334ff10e4c89a3a1a54e
SHA256f18885498843331ea4735ea7ce129873c039c863971247a18c2ab212424b09c8
SHA5129c528692df535c50473947d6f3d09b04cabeb26cbc441126a9dff8a192368b494c8c607f509ec6468c5ea92ec9753daa81c9000db5bcac8e51e93689e18a8617