Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
14/02/2024, 16:43
General
-
Target
setordinal.dll
-
Size
798KB
-
MD5
98fbaff7bb8c06503ea8bc14cb1c8427
-
SHA1
a6feec5c9227a1bf3d02afdad2b7a766900dbcb7
-
SHA256
43b63fdd1a3e68c641201e1ddc2d8adff31cbc7ea573c26e831de3cfcc3bc818
-
SHA512
65155e8ebb7fcb8316b73842d09772ccc220d660d136e633991b174b9887fe80e0c7dacbd413d2e4ed2dd730159ea1ea0ca8543b4de8ff1b38ad9176bc3979c9
-
SSDEEP
12288:q/cSVrV6nK0AtRTxsdzvbFbkag0UvMzK4NWJFgVgU5Sz9duW/TC6vhWDsghGdQxI:kcS1V6injBdQx3VcNNW8QO
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\setordinal.dll,#11⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_765773b8.dll", #12⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
798KB
MD598fbaff7bb8c06503ea8bc14cb1c8427
SHA1a6feec5c9227a1bf3d02afdad2b7a766900dbcb7
SHA25643b63fdd1a3e68c641201e1ddc2d8adff31cbc7ea573c26e831de3cfcc3bc818
SHA51265155e8ebb7fcb8316b73842d09772ccc220d660d136e633991b174b9887fe80e0c7dacbd413d2e4ed2dd730159ea1ea0ca8543b4de8ff1b38ad9176bc3979c9
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
820KB