Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/01/2024, 09:33
Static task
static1
Behavioral task
behavioral1
Sample
40814d97a4160e16800cc12ad8998fb0.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
40814d97a4160e16800cc12ad8998fb0.dll
Resource
win10v2004-20231215-en
General
-
Target
40814d97a4160e16800cc12ad8998fb0.dll
-
Size
80KB
-
MD5
40814d97a4160e16800cc12ad8998fb0
-
SHA1
774b55ca36e8f731a62aa1d34b20c5ac99572d5e
-
SHA256
b52886c98fb846b4f702f935e4bf61e9284d01ce2666c06581965b2093a6ae8e
-
SHA512
de547a6642bc0a09f463d4dbdb59c01f08dd867aff299c979b26bd4f2b92ce2f5e300c22326686c0213af52680304502e98c39dc31f8410dea9162044a3662e7
-
SSDEEP
1536:PUMWDtEKPPyAzdqW2SufHMOQQwncFIgPCm:4DtECPyAz1pCH8QHmgP
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1940 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2104 wrote to memory of 1940 2104 rundll32.exe 14 PID 2104 wrote to memory of 1940 2104 rundll32.exe 14 PID 2104 wrote to memory of 1940 2104 rundll32.exe 14 PID 2104 wrote to memory of 1940 2104 rundll32.exe 14 PID 2104 wrote to memory of 1940 2104 rundll32.exe 14 PID 2104 wrote to memory of 1940 2104 rundll32.exe 14 PID 2104 wrote to memory of 1940 2104 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\40814d97a4160e16800cc12ad8998fb0.dll,#11⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:1940
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\40814d97a4160e16800cc12ad8998fb0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2104