Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 22:21
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
4296238060c49e5ebf113063057fbbde.dll
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4296238060c49e5ebf113063057fbbde.dll
Resource
win10v2004-20240226-en
3 signatures
150 seconds
General
-
Target
4296238060c49e5ebf113063057fbbde.dll
-
Size
8KB
-
MD5
4296238060c49e5ebf113063057fbbde
-
SHA1
bd8373d472152354c0a6a80d233dffdf4aeb408d
-
SHA256
06b609bc6d8643dc66f9daadbee2df4053d2206388d933280683fe58977b4226
-
SHA512
110ab8c95ba3a76cc4cbc7c5ce6f09d2f347dea7cdd5140bcefa8508627d6a512a63d3b6e03877d80b89409b2be6bc405173fa14c38d25bd87a282303df0c243
-
SSDEEP
192:0h4SFyvWohE5xf6YUBSL63SUJqtMblWN:0O+ohE2B13NJqtM
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\satornas.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\satornas.dll rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1252 wrote to memory of 2872 1252 rundll32.exe 28 PID 1252 wrote to memory of 2872 1252 rundll32.exe 28 PID 1252 wrote to memory of 2872 1252 rundll32.exe 28 PID 1252 wrote to memory of 2872 1252 rundll32.exe 28 PID 1252 wrote to memory of 2872 1252 rundll32.exe 28 PID 1252 wrote to memory of 2872 1252 rundll32.exe 28 PID 1252 wrote to memory of 2872 1252 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4296238060c49e5ebf113063057fbbde.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4296238060c49e5ebf113063057fbbde.dll,#12⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2872
-