Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3ffb7e0228d...52.exe
windows7-x64
7ffb7e0228d...52.exe
windows10-2004-x64
7$PLUGINSDIR/INetC.dll
windows7-x64
3$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2024, 06:06 UTC
Static task
static1
Behavioral task
behavioral1
Sample
ffb7e0228d5212b01b82d48a1a058ada453228b70a0285e39822facefcc24e52.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ffb7e0228d5212b01b82d48a1a058ada453228b70a0285e39822facefcc24e52.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsisdl.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsisdl.dll
Resource
win10v2004-20231215-en
General
-
Target
$PLUGINSDIR/nsisdl.dll
-
Size
14KB
-
MD5
41f557e065b405f94d0ece8b5727233b
-
SHA1
c6d1704eefbdfe0a7d4a03c65acc70cdde883598
-
SHA256
9de492995d2180635aa3194b88ce6dd94e0c2b001af5952a73d4a84fbc32b6ab
-
SHA512
43b35b2366ba54593087c8c9127da5acc8efb45ebb84603138027692877173294b7478f8c6308ed9b168813c7b6d5f2b8dd261b75e58d0c97440baa4d0fbe493
-
SSDEEP
384:4ck76gi51kE5aYOMLDC4UnDp9B0Jc5HNw2rE:4ck76gibLCMLDLCx04HNVrE
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4060 4804 WerFault.exe 87 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5088 wrote to memory of 4804 5088 rundll32.exe 87 PID 5088 wrote to memory of 4804 5088 rundll32.exe 87 PID 5088 wrote to memory of 4804 5088 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisdl.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisdl.dll,#12⤵PID:4804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 6283⤵
- Program crash
PID:4060
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4804 -ip 48041⤵PID:504
Network
-
Remote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request180.178.17.96.in-addr.arpaIN PTRResponse180.178.17.96.in-addr.arpaIN PTRa96-17-178-180deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request2.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request31.243.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request31.243.111.52.in-addr.arpaIN PTR
-
73 B 147 B 1 1
DNS Request
149.220.183.52.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
180.178.17.96.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
2.159.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
103.169.127.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
18.134.221.88.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
31.243.111.52.in-addr.arpa
DNS Request
31.243.111.52.in-addr.arpa