Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    14/02/2024, 01:45

General

  • Target

    lpk.dll

  • Size

    45KB

  • MD5

    253047ba1fb3f5780f656e42468a98b6

  • SHA1

    41df12eff92915354f6870ece0fe09c03e96eaa4

  • SHA256

    5ab6d1bc176cc636e82dca6c557c49d06f06016d829aca6cec4761624231ce6d

  • SHA512

    1866f515851eaa71c4213a4680f239b88b38e88371a3414e3f7079321b740e45fa36c96304eb55e09c16a83532b4fa4c466f5fd3bf947e46cfcd8cb4c96b6dc3

  • SSDEEP

    768:tojY9P93amUkTe2uVf8VPZUpRwqK8RPRDUbojyH6ojY9P:Ym1a9iexVfevagojyHDm

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\lpk.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\lpk.dll,#1
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1276
      • C:\Users\Admin\AppData\Local\Temp\hrl83D0.tmp
        C:\Users\Admin\AppData\Local\Temp\hrl83D0.tmp
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:1052
  • C:\Windows\SysWOW64\rifzsk.exe
    C:\Windows\SysWOW64\rifzsk.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
        PID:2740

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\hrl83D0.tmp

      Filesize

      37KB

      MD5

      e90d8273d9f418adc5c2cb4e1e995559

      SHA1

      e7dff32bc9671d85e347415f5d5011acdd8aa9e6

      SHA256

      514319a4883c27820f1f08581aa3a0853643015ee0f4ec742739c118b327bdb1

      SHA512

      1dbf053d564039ca8c80f7fd6989dbdb42b191da6bbd70c97f81f41567891d6672910dd9c736a32146c896e2159677b41b3e46007ce70d9d4d9ea223a6b8a6d7

    • memory/2740-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2740-14-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/2740-16-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB