Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 07:37
Static task
static1
Behavioral task
behavioral1
Sample
43cbdc3f6713b36884152156a8bc737ffc0b350d43293d7039e594687d69c12a.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
43cbdc3f6713b36884152156a8bc737ffc0b350d43293d7039e594687d69c12a.dll
Resource
win10v2004-20231222-en
General
-
Target
43cbdc3f6713b36884152156a8bc737ffc0b350d43293d7039e594687d69c12a.dll
-
Size
397KB
-
MD5
4c1afc13ff76f2124b581b65414f9bba
-
SHA1
6d9f8e452f4ed37e5ca2e3fb41b77292a7204268
-
SHA256
43cbdc3f6713b36884152156a8bc737ffc0b350d43293d7039e594687d69c12a
-
SHA512
9f2c2487eba65ff9b29f3201d32bed2e9169d162988349f60b463e6904819626bc43cd69e10ade1d0c4b2b1e4cc57b61abd5713d2e386a11ec5661d77780d694
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaC:174g2LDeiPDImOkx2LIaC
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 696 rundll32.exe 696 rundll32.exe 696 rundll32.exe 696 rundll32.exe 696 rundll32.exe 696 rundll32.exe 696 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 696 rundll32.exe Token: SeTcbPrivilege 696 rundll32.exe Token: SeManageVolumePrivilege 3116 svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3976 wrote to memory of 696 3976 rundll32.exe 80 PID 3976 wrote to memory of 696 3976 rundll32.exe 80 PID 3976 wrote to memory of 696 3976 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\43cbdc3f6713b36884152156a8bc737ffc0b350d43293d7039e594687d69c12a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\43cbdc3f6713b36884152156a8bc737ffc0b350d43293d7039e594687d69c12a.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:696
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:1044
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3116