Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
599s -
max time network
601s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
14/02/2024, 16:56
Static task
static1
Behavioral task
behavioral1
Sample
72db19a5ccc7e378e72bd3cf8339280fc47f05b5ff65b1fb3893be6369a5c8bf.dll
Resource
win10-20231215-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
72db19a5ccc7e378e72bd3cf8339280fc47f05b5ff65b1fb3893be6369a5c8bf.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
72db19a5ccc7e378e72bd3cf8339280fc47f05b5ff65b1fb3893be6369a5c8bf.dll
Resource
win11-20231215-en
windows11-21h2-x64
General
-
Target
72db19a5ccc7e378e72bd3cf8339280fc47f05b5ff65b1fb3893be6369a5c8bf.dll
-
Size
59KB
-
MD5
128f2c45abb340712b5bdb9787664877
-
SHA1
e49dc6a12c76c9adf7a66e753b835fcd1cb48083
-
SHA256
72db19a5ccc7e378e72bd3cf8339280fc47f05b5ff65b1fb3893be6369a5c8bf
-
SHA512
6a2a4a1c4a5cc6ca2155ffd7f8849e73dba149e3b32beec13a37e68295f5f384195f7fc88eb2d4f1c3692ed3e4230b0383630842a8950b636e6a21806553fc70
-
SSDEEP
768:xiC/DyfvDF9JN1O7zub7+IJSuCMajTiAmPbjQLMf8shs1Fw9Dy:oC/DivXkOJSuwjFmz0Lchs1FAG
Malware Config
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 7 3312 rundll32.exe 8 3312 rundll32.exe 9 3312 rundll32.exe 10 3312 rundll32.exe 11 3312 rundll32.exe 12 3312 rundll32.exe 13 3312 rundll32.exe 14 3312 rundll32.exe 15 3312 rundll32.exe 16 3312 rundll32.exe 18 3312 rundll32.exe 19 3312 rundll32.exe 20 3312 rundll32.exe 21 3312 rundll32.exe 22 3312 rundll32.exe 23 3312 rundll32.exe 24 3312 rundll32.exe 25 3312 rundll32.exe 26 3312 rundll32.exe 27 3312 rundll32.exe 28 3312 rundll32.exe 29 3312 rundll32.exe 30 3312 rundll32.exe 31 3312 rundll32.exe 32 3312 rundll32.exe 33 3312 rundll32.exe 34 3312 rundll32.exe 35 3312 rundll32.exe 36 3312 rundll32.exe 37 3312 rundll32.exe 38 3312 rundll32.exe 39 3312 rundll32.exe 40 3312 rundll32.exe 41 3312 rundll32.exe 42 3312 rundll32.exe 43 3312 rundll32.exe 44 3312 rundll32.exe 45 3312 rundll32.exe 46 3312 rundll32.exe 47 3312 rundll32.exe 48 3312 rundll32.exe 49 3312 rundll32.exe 50 3312 rundll32.exe 51 3312 rundll32.exe 52 3312 rundll32.exe 53 3312 rundll32.exe 54 3312 rundll32.exe 55 3312 rundll32.exe 56 3312 rundll32.exe 57 3312 rundll32.exe 58 3312 rundll32.exe 59 3312 rundll32.exe 60 3312 rundll32.exe 61 3312 rundll32.exe 62 3312 rundll32.exe 63 3312 rundll32.exe 64 3312 rundll32.exe 65 3312 rundll32.exe 66 3312 rundll32.exe 67 3312 rundll32.exe 68 3312 rundll32.exe 69 3312 rundll32.exe 70 3312 rundll32.exe 71 3312 rundll32.exe -
Deletes itself 1 IoCs
pid Process 3264 rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 3312 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3264 rundll32.exe 3264 rundll32.exe 3264 rundll32.exe 3264 rundll32.exe 3312 rundll32.exe 3312 rundll32.exe 3312 rundll32.exe 3312 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3264 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3264 wrote to memory of 3312 3264 rundll32.exe 77 PID 3264 wrote to memory of 3312 3264 rundll32.exe 77 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\72db19a5ccc7e378e72bd3cf8339280fc47f05b5ff65b1fb3893be6369a5c8bf.dll,#11⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_4ca9dd3.dll", #12⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3312
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5128f2c45abb340712b5bdb9787664877
SHA1e49dc6a12c76c9adf7a66e753b835fcd1cb48083
SHA25672db19a5ccc7e378e72bd3cf8339280fc47f05b5ff65b1fb3893be6369a5c8bf
SHA5126a2a4a1c4a5cc6ca2155ffd7f8849e73dba149e3b32beec13a37e68295f5f384195f7fc88eb2d4f1c3692ed3e4230b0383630842a8950b636e6a21806553fc70