Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 11:15
Static task
static1
Behavioral task
behavioral1
Sample
7fb3c7e32f84d7720ca78e9bfc7f8224.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7fb3c7e32f84d7720ca78e9bfc7f8224.dll
Resource
win10v2004-20231215-en
General
-
Target
7fb3c7e32f84d7720ca78e9bfc7f8224.dll
-
Size
57KB
-
MD5
7fb3c7e32f84d7720ca78e9bfc7f8224
-
SHA1
2ee723cf67624121f9d942c1328e90d27b4e593c
-
SHA256
559da6badb2092d46a96dc0ebc7419c54876edd78fa4f14837c822db88ec5332
-
SHA512
97b202c78ad4b75510918c39eb2a4dc38a92e26fd40b5f74efaa7d51f7c713839783c22b7b828de86451acb33322fc95af78a5fd83dd8ae6bb96626fdeb5f98e
-
SSDEEP
768:HnPIspNqsKap/K/U26go3UTRRYOoMoBb9CF5FoayLfcT2awAaVB2cqR:vQO5Kc1kTRRYg8m5FoayoT8A0
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3612 wrote to memory of 5084 3612 rundll32.exe 83 PID 3612 wrote to memory of 5084 3612 rundll32.exe 83 PID 3612 wrote to memory of 5084 3612 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7fb3c7e32f84d7720ca78e9bfc7f8224.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7fb3c7e32f84d7720ca78e9bfc7f8224.dll,#12⤵
- Checks BIOS information in registry
PID:5084
-