Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 06:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c62ee8a2a75daa0e436c91a1a479155.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2c62ee8a2a75daa0e436c91a1a479155.exe
Resource
win10v2004-20231215-en
9 signatures
150 seconds
General
-
Target
2c62ee8a2a75daa0e436c91a1a479155.exe
-
Size
52KB
-
MD5
2c62ee8a2a75daa0e436c91a1a479155
-
SHA1
2ab886b656fbf2750685fa225471865ecd21c9e2
-
SHA256
f8a03ac431ceecc76e1f3af12ea948c3da3c057b5f0449f0474d5bb02933c58f
-
SHA512
e2fb3f25b565792d7d8dff123e91e6fd28c09a86f678508855a21375043b373eca3cb6d1f2571f025f80ef18cd5a69076e3e67ef355421cdc8a7fd396dea16a7
-
SSDEEP
768:RUEMjlLXFqG2q6DXjCGNL3fn2pCrllkUz6pwN75yTJUlTdKcrKJU3mLY8:RslLVF6DXjCGBf0CrllFm+N7CCscrjkp
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 1920 2c62ee8a2a75daa0e436c91a1a479155.exe 4424 rundll32.exe -
resource yara_rule behavioral2/memory/1920-1-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/1920-4-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/1920-2-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/1920-14-0x0000000010000000-0x000000001001B000-memory.dmp upx behavioral2/memory/1920-12-0x0000000010000000-0x000000001001B000-memory.dmp upx behavioral2/memory/1920-11-0x0000000010000000-0x000000001001B000-memory.dmp upx behavioral2/memory/1920-10-0x0000000010000000-0x000000001001B000-memory.dmp upx behavioral2/memory/4424-24-0x0000000010000000-0x000000001001B000-memory.dmp upx behavioral2/memory/4424-30-0x0000000010000000-0x000000001001B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSServer = "rundll32.exe C:\\Windows\\system32\\efcAQGAR.dll,#1" rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\efcAQGAR.dll 2c62ee8a2a75daa0e436c91a1a479155.exe File created C:\Windows\SysWOW64\efcAQGAR.dll 2c62ee8a2a75daa0e436c91a1a479155.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}\InprocServer32\ = "C:\\Windows\\SysWow64\\efcAQGAR.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}\InprocServer32\ThreadingModel = "Both" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1920 2c62ee8a2a75daa0e436c91a1a479155.exe 1920 2c62ee8a2a75daa0e436c91a1a479155.exe 4424 rundll32.exe 4424 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1920 2c62ee8a2a75daa0e436c91a1a479155.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1920 2c62ee8a2a75daa0e436c91a1a479155.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1920 wrote to memory of 612 1920 2c62ee8a2a75daa0e436c91a1a479155.exe 4 PID 1920 wrote to memory of 4424 1920 2c62ee8a2a75daa0e436c91a1a479155.exe 100 PID 1920 wrote to memory of 4424 1920 2c62ee8a2a75daa0e436c91a1a479155.exe 100 PID 1920 wrote to memory of 4424 1920 2c62ee8a2a75daa0e436c91a1a479155.exe 100 PID 1920 wrote to memory of 2552 1920 2c62ee8a2a75daa0e436c91a1a479155.exe 102 PID 1920 wrote to memory of 2552 1920 2c62ee8a2a75daa0e436c91a1a479155.exe 102 PID 1920 wrote to memory of 2552 1920 2c62ee8a2a75daa0e436c91a1a479155.exe 102
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\2c62ee8a2a75daa0e436c91a1a479155.exe"C:\Users\Admin\AppData\Local\Temp\2c62ee8a2a75daa0e436c91a1a479155.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\system32\efcAQGAR.dll,a2⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4424
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nnnmjihh.bat "C:\Users\Admin\AppData\Local\Temp\2c62ee8a2a75daa0e436c91a1a479155.exe"2⤵PID:2552
-