Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/03/2024, 12:15
Behavioral task
behavioral1
Sample
c5d96163360e4ab5277af98a93fee026.dll
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
c5d96163360e4ab5277af98a93fee026.dll
-
Size
21KB
-
MD5
c5d96163360e4ab5277af98a93fee026
-
SHA1
73d4054e44ef572c081e196b1648db460559ec0e
-
SHA256
9db577c5bef5dc59ae44dbca8cf33d67b9a13d5436d75ef4d6575fdcf164a033
-
SHA512
75bed6f1902347899bf656b6a902956612de59a9e812700d8b3e1390ae1679bfb9ac674abaae4a7bb796941c223e776980b1bbf1acc31b8d300910104f79c975
-
SSDEEP
384:8FIGobdtgfOm+Tyj0qO6aIMloJrtES9CofyXVnW8SoDSTE4p:8F6bdtcVI7duQS+WASTEs
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\ rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\rundll32.exe = "C:\\Windows\\SysWOW64\\rundll32.exe:*:Enabled:rundll32" rundll32.exe -
resource yara_rule behavioral1/memory/2148-0-0x0000000010000000-0x0000000010039000-memory.dmp upx behavioral1/memory/2148-1-0x0000000010000000-0x0000000010039000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\vkj.bin rundll32.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe 2148 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2148 2160 rundll32.exe 28 PID 2160 wrote to memory of 2148 2160 rundll32.exe 28 PID 2160 wrote to memory of 2148 2160 rundll32.exe 28 PID 2160 wrote to memory of 2148 2160 rundll32.exe 28 PID 2160 wrote to memory of 2148 2160 rundll32.exe 28 PID 2160 wrote to memory of 2148 2160 rundll32.exe 28 PID 2160 wrote to memory of 2148 2160 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c5d96163360e4ab5277af98a93fee026.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c5d96163360e4ab5277af98a93fee026.dll,#12⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: LoadsDriver
PID:2148
-