Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
09/01/2024, 13:23
Behavioral task
behavioral1
Sample
4e6ac23cf16f054b9b79ccbe0e486f82.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4e6ac23cf16f054b9b79ccbe0e486f82.dll
Resource
win10v2004-20231215-en
General
-
Target
4e6ac23cf16f054b9b79ccbe0e486f82.dll
-
Size
299KB
-
MD5
4e6ac23cf16f054b9b79ccbe0e486f82
-
SHA1
0c4572af283c893d87c6040b795150ab55ec0577
-
SHA256
dae8b56e57d10b540c1664c824fe0dfb6316a8dee0722d1d57b7961147cd857c
-
SHA512
73327aaa38b9949219f2d19358f8a8b217d0022483af19acaf75ee3c702205bfbb58915462c7f8760bd27a5ea972b8e7118b572d37c954a2ebb53c672c171817
-
SSDEEP
6144:rTW3YgVzMS73tzrVmSavGXQ+90sGjGms4+/NoNZra8dOJCUJUeANlq:rTW3YmzMc3tzrVmLvGA5sGimst/NQ/U7
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\rundll32.exe: $TASK rundll32.exe File opened for modification C:\Windows\system32\rundll32.exe: $FILE rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1172 taskeng.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1172 wrote to memory of 1180 1172 taskeng.exe 31 PID 1172 wrote to memory of 1180 1172 taskeng.exe 31 PID 1172 wrote to memory of 1180 1172 taskeng.exe 31 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4e6ac23cf16f054b9b79ccbe0e486f82.dll,#11⤵
- Drops file in System32 directory
PID:2436
-
C:\Windows\system32\taskeng.exetaskeng.exe {0B37E2FC-E9EF-4E73-8D80-F1059FF3C46F} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe -u2⤵PID:1180
-