Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/01/2024, 12:44
Static task
static1
Behavioral task
behavioral1
Sample
40e4c083da257bb7c0bc04f7eeef4299.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
40e4c083da257bb7c0bc04f7eeef4299.dll
Resource
win10v2004-20231222-en
General
-
Target
40e4c083da257bb7c0bc04f7eeef4299.dll
-
Size
120KB
-
MD5
40e4c083da257bb7c0bc04f7eeef4299
-
SHA1
16426053b1ad93fa3832b4f083f1bbce8d172992
-
SHA256
40467bf55d34e7d3b57b18729154072ef2c310446a9814f82533ec004fc9be8d
-
SHA512
65bcf4d25a0fd984303538ad1a8cdff0f096ab0cfc14e54e4419fa78cc2e1b56b980b8cca55cc63d6b6db97221345d7833519dc1e770a89f05276faf202542e9
-
SSDEEP
3072:DJq8LGgTkFZ2wn/nVwpuqmWa8b8+vnCwjxZ/tC:D4EdkFoePVxua23nfjPtC
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1784 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2448 wrote to memory of 1784 2448 rundll32.exe 28 PID 2448 wrote to memory of 1784 2448 rundll32.exe 28 PID 2448 wrote to memory of 1784 2448 rundll32.exe 28 PID 2448 wrote to memory of 1784 2448 rundll32.exe 28 PID 2448 wrote to memory of 1784 2448 rundll32.exe 28 PID 2448 wrote to memory of 1784 2448 rundll32.exe 28 PID 2448 wrote to memory of 1784 2448 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\40e4c083da257bb7c0bc04f7eeef4299.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\40e4c083da257bb7c0bc04f7eeef4299.dll,#12⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:1784
-