Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    17s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/03/2024, 17:35

General

  • Target

    oringo.dll

  • Size

    2.0MB

  • MD5

    473355fa4b769f1a1d5e1581dbfbd702

  • SHA1

    f2da0b6ae86a1c72224e1df8b1c3b8106fc8f25c

  • SHA256

    c1bea49c84c424abeb53becd24c55e1f2637d250780808889a5a5a2b34e49015

  • SHA512

    99d82caa4afe96010ad9d44f172b24e61cd06a57ce7a86992154937401f4b5f89c073eed4e358bf6a3c7dad0dfbe7c12c430c71f41baad36d63ca9a78f25ac56

  • SSDEEP

    49152:o7vX2xRW4f1I167Mbr3LgRqSiFq+Iq3sG:o705E8ISiFqEsG

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\oringo.dll,#1
    1⤵
    • Blocklisted process makes network request
    • Modifies system certificate store
    PID:2240

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    67KB

    MD5

    753df6889fd7410a2e9fe333da83a429

    SHA1

    3c425f16e8267186061dd48ac1c77c122962456e

    SHA256

    b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

    SHA512

    9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4a41c57b4933e9696f2ec97d0288509c

    SHA1

    64520ffeef9491240b8de3a80384424a295f1de5

    SHA256

    bc5a39763a1b24ea16754e86c07e7e929a29fc889c3034bf087accc1b4b21eb7

    SHA512

    3ef40b1791ac7f876ad9b9f9ce13adab7defa5e7c04eae061d079cb32bb29e9acefec3b2e2c750ce5aeb04743984ee9b3dda12ac9c109b3c5cbc1c6a5ab7af73

  • C:\Users\Admin\AppData\Local\Temp\Cab1A46.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar359A.tmp

    Filesize

    175KB

    MD5

    dd73cead4b93366cf3465c8cd32e2796

    SHA1

    74546226dfe9ceb8184651e920d1dbfb432b314e

    SHA256

    a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

    SHA512

    ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63