Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
161s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24/02/2024, 10:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a1ad11f289c2dc0de07f8a28f5a8b1b9.dll
Resource
win7-20240215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a1ad11f289c2dc0de07f8a28f5a8b1b9.dll
Resource
win10v2004-20240221-en
4 signatures
150 seconds
General
-
Target
a1ad11f289c2dc0de07f8a28f5a8b1b9.dll
-
Size
260KB
-
MD5
a1ad11f289c2dc0de07f8a28f5a8b1b9
-
SHA1
a79dd7ad9671c67a6e98d59f480c6d829a7d7ac2
-
SHA256
e9b8a53a61e348af82b208cd3b04167608e34531c62b6ba0b0ecefaccd74a9b3
-
SHA512
c2e693f32903f52ddea1298927c42d7a77da0d0027de7db9cd4a84165de6ffd4ef49c3a55f895303c0360243dbf98c44c84f0b2cb894d01b21b324601e531f2b
-
SSDEEP
6144:qyIrp70RRQUMnBk8X4UnqSpO0wsxsX9N6cjmF8:qrrpgvMnS8oUnqSpVwsxA9N6
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Nkajafugahopir = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\a1ad11f289c2dc0de07f8a28f5a8b1b9.dll\",Startup" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3560 rundll32.exe 3560 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3560 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1040 wrote to memory of 3560 1040 rundll32.exe 85 PID 1040 wrote to memory of 3560 1040 rundll32.exe 85 PID 1040 wrote to memory of 3560 1040 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a1ad11f289c2dc0de07f8a28f5a8b1b9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a1ad11f289c2dc0de07f8a28f5a8b1b9.dll,#12⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3560
-