Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 12:15
Behavioral task
behavioral1
Sample
c5d96163360e4ab5277af98a93fee026.dll
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
c5d96163360e4ab5277af98a93fee026.dll
-
Size
21KB
-
MD5
c5d96163360e4ab5277af98a93fee026
-
SHA1
73d4054e44ef572c081e196b1648db460559ec0e
-
SHA256
9db577c5bef5dc59ae44dbca8cf33d67b9a13d5436d75ef4d6575fdcf164a033
-
SHA512
75bed6f1902347899bf656b6a902956612de59a9e812700d8b3e1390ae1679bfb9ac674abaae4a7bb796941c223e776980b1bbf1acc31b8d300910104f79c975
-
SSDEEP
384:8FIGobdtgfOm+Tyj0qO6aIMloJrtES9CofyXVnW8SoDSTE4p:8F6bdtcVI7duQS+WASTEs
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\rundll32.exe = "C:\\Windows\\SysWOW64\\rundll32.exe:*:Enabled:rundll32" rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\ rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications rundll32.exe -
resource yara_rule behavioral2/memory/4796-0-0x0000000010000000-0x0000000010039000-memory.dmp upx behavioral2/memory/4796-1-0x0000000010000000-0x0000000010039000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\vkj.bin rundll32.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe 4796 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4980 wrote to memory of 4796 4980 rundll32.exe 86 PID 4980 wrote to memory of 4796 4980 rundll32.exe 86 PID 4980 wrote to memory of 4796 4980 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c5d96163360e4ab5277af98a93fee026.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c5d96163360e4ab5277af98a93fee026.dll,#12⤵
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious behavior: LoadsDriver
PID:4796
-