Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 14:22 UTC

General

  • Target

    39ac6f78e012433fa9bf0e553cfa67e7.dll

  • Size

    64KB

  • MD5

    39ac6f78e012433fa9bf0e553cfa67e7

  • SHA1

    a91489d78d3e342c55e2c6ecbdc2649334612dcb

  • SHA256

    2b6392d854b3747eb5b728eaf1f37dab3de9ef2ec9f6140c9e3c969ccf4fcbd3

  • SHA512

    ce1852f8430dd8f17ae873a9f7521265a506b658390b4fc2cfcb1237d11824870e2880a98be5c9dc6a173308b60fb1ec9c127bc7d0e12511dcc9547c2c313c23

  • SSDEEP

    768:zafQmHy4c93vGSxt7j7g1E9wWEWJJd3G5U3s4xQMm37L3EVgfRO+ozTlt:rmS9T5ftwWTGm3O33/IJ1

Score
8/10

Malware Config

Signatures

  • Modifies AppInit DLL entries 2 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\39ac6f78e012433fa9bf0e553cfa67e7.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\39ac6f78e012433fa9bf0e553cfa67e7.dll,#1
      2⤵
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2220
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Users\Admin\AppData\Local\Temp\a.reg
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3028
        • C:\Windows\SysWOW64\regedit.exe
          "regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\a.reg"
          4⤵
          • Runs .reg file with regedit
          PID:2652

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\a.reg

    Filesize

    152B

    MD5

    b100f5324ef74ded0b998e64d07a2e19

    SHA1

    40b0d7f51bf2dd8451f1b723d21355c471a5fa46

    SHA256

    3db613d24a75ae220891698c055e1c580a42e58564f568a0510db87581cc2042

    SHA512

    c12391bb37c334074f7d7e1257b6364fd5cbce848e0a8fe15b8326f54fd9568fe3baec58618c4334027a774a06a08ec249cb71db925c1f85feee6a3d3a816c04

  • memory/2220-0-0x0000000010000000-0x0000000010010000-memory.dmp

    Filesize

    64KB

  • memory/2220-1-0x0000000010000000-0x0000000010010000-memory.dmp

    Filesize

    64KB

  • memory/2220-3-0x0000000010000000-0x0000000010010000-memory.dmp

    Filesize

    64KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.