Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
07/04/2024, 23:23
Behavioral task
behavioral1
Sample
910279c68cffd08f17544d64099cb8e7bd98aba8c51cc5853c597762c8ff24ee.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
910279c68cffd08f17544d64099cb8e7bd98aba8c51cc5853c597762c8ff24ee.dll
Resource
win10v2004-20240226-en
General
-
Target
910279c68cffd08f17544d64099cb8e7bd98aba8c51cc5853c597762c8ff24ee.dll
-
Size
76KB
-
MD5
ada62f8c6739afd1e3dcc62e8914ef96
-
SHA1
eb22bbaf8d4b0702dc60b545110a7184a8e62402
-
SHA256
910279c68cffd08f17544d64099cb8e7bd98aba8c51cc5853c597762c8ff24ee
-
SHA512
6d4374f1c804b5ce3ca2e7651100a6833faae78f03e0538e66a7de407e71aa7041bfe2c5016e4b0f6f4ba06fec6d337508f83916b251f06c9e9bd5451f3fd099
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZgNs:c8y93KQjy7G55riF1cMo03Z
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral1/memory/2032-0-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2032-1-0x0000000010000000-0x0000000010030000-memory.dmp UPX -
Modifies AppInit DLL entries 2 TTPs
-
resource yara_rule behavioral1/memory/2032-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2032-1-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2948 2032 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2032 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1364 wrote to memory of 2032 1364 rundll32.exe 28 PID 1364 wrote to memory of 2032 1364 rundll32.exe 28 PID 1364 wrote to memory of 2032 1364 rundll32.exe 28 PID 1364 wrote to memory of 2032 1364 rundll32.exe 28 PID 1364 wrote to memory of 2032 1364 rundll32.exe 28 PID 1364 wrote to memory of 2032 1364 rundll32.exe 28 PID 1364 wrote to memory of 2032 1364 rundll32.exe 28 PID 2032 wrote to memory of 2948 2032 rundll32.exe 29 PID 2032 wrote to memory of 2948 2032 rundll32.exe 29 PID 2032 wrote to memory of 2948 2032 rundll32.exe 29 PID 2032 wrote to memory of 2948 2032 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\910279c68cffd08f17544d64099cb8e7bd98aba8c51cc5853c597762c8ff24ee.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\910279c68cffd08f17544d64099cb8e7bd98aba8c51cc5853c597762c8ff24ee.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 3283⤵
- Program crash
PID:2948
-
-