Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
169s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 13:58
Static task
static1
Behavioral task
behavioral1
Sample
38ecc7d5925c74865593202c07ad7235.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
38ecc7d5925c74865593202c07ad7235.dll
Resource
win10v2004-20231215-en
General
-
Target
38ecc7d5925c74865593202c07ad7235.dll
-
Size
634KB
-
MD5
38ecc7d5925c74865593202c07ad7235
-
SHA1
26bc0d81f8dcb7b9934bc9170c35e3dda5392861
-
SHA256
5b8be73276a2447f9128724eb5563b34c7178a82b4e2e9bcfe56f60c87dc84d8
-
SHA512
d954928453ab42610f7e33c383b7ac4421314f6c8baf8422673b882f8056559af8267816bc871e23ebf479f08dd96913089c5fd44129a61445ddea417662d679
-
SSDEEP
12288:Ppt/90f0PsKJcH812JVrMa952t7FXGOFjTs3fsTq5lVDRdQ:z68POH8QJVr2djTq0eDFR
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\gzugs.sys rundll32.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\{646BD6D86619930BEBCE93AEC6C0CC8B}\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\F0C9.tmp" rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 2060 regsvr32.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 680 Process not Found -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4928 wrote to memory of 4984 4928 rundll32.exe 88 PID 4928 wrote to memory of 4984 4928 rundll32.exe 88 PID 4928 wrote to memory of 4984 4928 rundll32.exe 88 PID 4984 wrote to memory of 2060 4984 rundll32.exe 92 PID 4984 wrote to memory of 2060 4984 rundll32.exe 92 PID 4984 wrote to memory of 2060 4984 rundll32.exe 92
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\38ecc7d5925c74865593202c07ad7235.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\38ecc7d5925c74865593202c07ad7235.dll,#12⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\D0FC.tmp3⤵
- Loads dropped DLL
PID:2060
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD5ff62d9d6da30048dcee4eb1c6385c9fe
SHA1b2d5e6a52378c30824a395077bb2c3be79c3fa73
SHA25694f677280dda5223f6d1a3acaa2285a372e9f6e7aa46824cd8632dea25cde71c
SHA512041845518c124fa0260abe1da11e7271908019030becf52896c3088739fb803530426df141c42f7238db77a77b1bbab9854c51198c0765f758c6976654b1f811
-
Filesize
142KB
MD5cd551aa397f7c7ca4e9014bfbb6e0b98
SHA103a3475328d770ab0ae76bddc0d908bc8b3003ed
SHA256f8de72ef385066b5c9acd3758eba4f8177cdd33bd9c361424e24185de1f231f0
SHA5123494469560617f6a30e40f6478063e47af9618681dd27bc6db5cbda8715eb12090ea1fd89e06791254ae14010d67cb1a46851d93df914addad2daef04c9fe2e2