Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2024, 14:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bee07a6a427307c24ef03660dfa8f57b.dll
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bee07a6a427307c24ef03660dfa8f57b.dll
Resource
win10v2004-20240226-en
3 signatures
150 seconds
General
-
Target
bee07a6a427307c24ef03660dfa8f57b.dll
-
Size
212KB
-
MD5
bee07a6a427307c24ef03660dfa8f57b
-
SHA1
e7590e5292017963d3e7b868c3a644a1fc12ecab
-
SHA256
5be5fb448a0fceea709cf4bd820395512d107356c939d38992396a63b04cfe77
-
SHA512
0039acf2a452635a705708f50a9c746d2f7010c5b2cb0c613b7b98b87867d35097af50257786badd51df19cc5815c619eff7e55e591c669a4f22d1d64cdd2ee6
-
SSDEEP
3072:GapDVrIVdZRmxbF76mXFufWAvouH8xh54eM5kEpUrzEtjOF8RM3:DZrIXZRmxJPq4KtpWz6ZM3
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\aslpmqk = "{BB65E4B2-ED0B-4BCD-A417-A23420C5F50E}" rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB65E4B2-ED0B-4BCD-A417-A23420C5F50E}\InProcServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB65E4B2-ED0B-4BCD-A417-A23420C5F50E} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB65E4B2-ED0B-4BCD-A417-A23420C5F50E}\InProcServer32\ = "C:\\Windows\\aslpmqk.dll" rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1304 wrote to memory of 4652 1304 rundll32.exe 94 PID 1304 wrote to memory of 4652 1304 rundll32.exe 94 PID 1304 wrote to memory of 4652 1304 rundll32.exe 94
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bee07a6a427307c24ef03660dfa8f57b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bee07a6a427307c24ef03660dfa8f57b.dll,#12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3472 --field-trial-handle=2260,i,3303482231723870786,2954015409682154873,262144 --variations-seed-version /prefetch:81⤵PID:3452