Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1List of su...ts.lnk
windows7-x64
10List of su...ts.lnk
windows10-2004-x64
10List of su...ll.dll
windows7-x64
1List of su...ll.dll
windows10-2004-x64
1List of su...es.pdf
windows7-x64
1List of su...es.pdf
windows10-2004-x64
1List of su...40.dll
windows7-x64
3List of su...40.dll
windows10-2004-x64
3List of su...gr.dll
windows7-x64
1List of su...gr.dll
windows10-2004-x64
3List of su...rv.exe
windows7-x64
10List of su...rv.exe
windows10-2004-x64
10List of su...dt.dll
windows7-x64
1List of su...dt.dll
windows10-2004-x64
1List of su...40.dll
windows7-x64
List of su...40.dll
windows10-2004-x64
3List of su...ce.dll
windows7-x64
1List of su...ce.dll
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 19:10
Static task
static1
Behavioral task
behavioral1
Sample
List of suspected clients/List of suspected clients.lnk
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
List of suspected clients/List of suspected clients.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
List of suspected clients/WCLDll.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
List of suspected clients/WCLDll.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
List of suspected clients/moorefiles.pdf
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
List of suspected clients/moorefiles.pdf
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
List of suspected clients/msvcp140.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
List of suspected clients/msvcp140.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
List of suspected clients/ptMgr.dll
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
List of suspected clients/ptMgr.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
List of suspected clients/ptSrv.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
List of suspected clients/ptSrv.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
List of suspected clients/ptusredt.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
List of suspected clients/ptusredt.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
List of suspected clients/vcruntime140.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
List of suspected clients/vcruntime140.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
List of suspected clients/wbxtrace.dll
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
List of suspected clients/wbxtrace.dll
Resource
win10v2004-20240226-en
General
-
Target
List of suspected clients/WCLDll.dll
-
Size
590KB
-
MD5
9005812bebfcc98db95def5b1c9b96f0
-
SHA1
d85f085c59fe8cca75352399ebc8510e2799bf68
-
SHA256
8acf6eea851ccd43a33eee9840794b9944eed61e5be0a7c403b79d3baa48940c
-
SHA512
c25c4eaef2d40d5294fcd2b15f3065cb3c6cad19cc5c32da4a81b20d99023dbfcccfa5fbc2d79f45892f7d858c04d956f1734d0359054fae9e609a5d604ab0b1
-
SSDEEP
12288:i+Se970XqzxUmUkVakh1d4wJjfXB7w86ywKUc6A9iSOJ7zP8cl7ksEjwdA9iOaQ:ce97qqzxXUkckh1d4wJjfB8vywKUc6A7
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2180 wrote to memory of 1112 2180 rundll32.exe 28 PID 2180 wrote to memory of 1112 2180 rundll32.exe 28 PID 2180 wrote to memory of 1112 2180 rundll32.exe 28 PID 2180 wrote to memory of 1112 2180 rundll32.exe 28 PID 2180 wrote to memory of 1112 2180 rundll32.exe 28 PID 2180 wrote to memory of 1112 2180 rundll32.exe 28 PID 2180 wrote to memory of 1112 2180 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\List of suspected clients\WCLDll.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\List of suspected clients\WCLDll.dll",#12⤵PID:1112
-