Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/03/2024, 14:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bee07a6a427307c24ef03660dfa8f57b.dll
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bee07a6a427307c24ef03660dfa8f57b.dll
Resource
win10v2004-20240226-en
3 signatures
150 seconds
General
-
Target
bee07a6a427307c24ef03660dfa8f57b.dll
-
Size
212KB
-
MD5
bee07a6a427307c24ef03660dfa8f57b
-
SHA1
e7590e5292017963d3e7b868c3a644a1fc12ecab
-
SHA256
5be5fb448a0fceea709cf4bd820395512d107356c939d38992396a63b04cfe77
-
SHA512
0039acf2a452635a705708f50a9c746d2f7010c5b2cb0c613b7b98b87867d35097af50257786badd51df19cc5815c619eff7e55e591c669a4f22d1d64cdd2ee6
-
SSDEEP
3072:GapDVrIVdZRmxbF76mXFufWAvouH8xh54eM5kEpUrzEtjOF8RM3:DZrIXZRmxJPq4KtpWz6ZM3
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\aslpmqk = "{CE5A62AC-ED37-4772-BEA3-C345C8DAAF69}" rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE5A62AC-ED37-4772-BEA3-C345C8DAAF69} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE5A62AC-ED37-4772-BEA3-C345C8DAAF69}\InProcServer32\ = "C:\\Windows\\aslpmqk.dll" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE5A62AC-ED37-4772-BEA3-C345C8DAAF69}\InProcServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2388 wrote to memory of 1668 2388 rundll32.exe 28 PID 2388 wrote to memory of 1668 2388 rundll32.exe 28 PID 2388 wrote to memory of 1668 2388 rundll32.exe 28 PID 2388 wrote to memory of 1668 2388 rundll32.exe 28 PID 2388 wrote to memory of 1668 2388 rundll32.exe 28 PID 2388 wrote to memory of 1668 2388 rundll32.exe 28 PID 2388 wrote to memory of 1668 2388 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bee07a6a427307c24ef03660dfa8f57b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bee07a6a427307c24ef03660dfa8f57b.dll,#12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1668
-