Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 11:51
Static task
static1
Behavioral task
behavioral1
Sample
1ee94721b3918667bd3ab456ece47ea644b71ab8e9085966254be64b310cf5ff.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1ee94721b3918667bd3ab456ece47ea644b71ab8e9085966254be64b310cf5ff.dll
Resource
win10v2004-20231222-en
General
-
Target
1ee94721b3918667bd3ab456ece47ea644b71ab8e9085966254be64b310cf5ff.dll
-
Size
397KB
-
MD5
5838620da824847de686fbfbf56a4378
-
SHA1
38a0f4e5502b1080d0b9f1b5bccf27e102819541
-
SHA256
1ee94721b3918667bd3ab456ece47ea644b71ab8e9085966254be64b310cf5ff
-
SHA512
90735ef57b526c2b4ec9361a5669c4231adc1cf5b207151465e1a55a8d139abf9bdc8926f6b3eedf93e60824bb7a758e379da52264e809146e4f58d97967be7a
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOah:174g2LDeiPDImOkx2LIah
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2936 rundll32.exe 2936 rundll32.exe 2936 rundll32.exe 2936 rundll32.exe 2936 rundll32.exe 2936 rundll32.exe 2936 rundll32.exe 2936 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2936 rundll32.exe Token: SeTcbPrivilege 2936 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2936 2740 rundll32.exe 62 PID 2740 wrote to memory of 2936 2740 rundll32.exe 62 PID 2740 wrote to memory of 2936 2740 rundll32.exe 62
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1ee94721b3918667bd3ab456ece47ea644b71ab8e9085966254be64b310cf5ff.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1ee94721b3918667bd3ab456ece47ea644b71ab8e9085966254be64b310cf5ff.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936
-