Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 11:46
Behavioral task
behavioral1
Sample
6f76d29b00e83d8fef479e9e261e4fe8f98db387c15d8d8bfebbe03b898c0131.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6f76d29b00e83d8fef479e9e261e4fe8f98db387c15d8d8bfebbe03b898c0131.dll
Resource
win10v2004-20240226-en
General
-
Target
6f76d29b00e83d8fef479e9e261e4fe8f98db387c15d8d8bfebbe03b898c0131.dll
-
Size
743KB
-
MD5
39e9973602915b568e471c662003f6ad
-
SHA1
10d7b6bfdf7af1b7121970948c2f9f8ee9bdd0b7
-
SHA256
6f76d29b00e83d8fef479e9e261e4fe8f98db387c15d8d8bfebbe03b898c0131
-
SHA512
46e0d8511931ca5905e012c029d7f14fd5aa958fb6e08e9d0b06c8edab0e66dcd0f99b2f6d34f161bb6f44bbe111606c8696d6ac78afe39509badd52b971d199
-
SSDEEP
12288:LK/B5QF5BV3wW9uD/mhCQFhvLulYMoGoPMP7ki0sD7VojMOVMl36W/8M:aB5QzB2W9xhzulYMoGoU7nD7VtOVMM4
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3192-0-0x0000000051D90000-0x0000000052162000-memory.dmp upx behavioral2/memory/3192-1-0x0000000051D90000-0x0000000052162000-memory.dmp upx -
Runs net.exe
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3192 wrote to memory of 3124 3192 rundll32.exe 88 PID 3192 wrote to memory of 3124 3192 rundll32.exe 88 PID 3124 wrote to memory of 3976 3124 cmd.exe 90 PID 3124 wrote to memory of 3976 3124 cmd.exe 90 PID 3976 wrote to memory of 2192 3976 net.exe 91 PID 3976 wrote to memory of 2192 3976 net.exe 91 PID 3192 wrote to memory of 1920 3192 rundll32.exe 93 PID 3192 wrote to memory of 1920 3192 rundll32.exe 93 PID 1920 wrote to memory of 2984 1920 cmd.exe 95 PID 1920 wrote to memory of 2984 1920 cmd.exe 95 PID 2984 wrote to memory of 208 2984 net.exe 96 PID 2984 wrote to memory of 208 2984 net.exe 96
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f76d29b00e83d8fef479e9e261e4fe8f98db387c15d8d8bfebbe03b898c0131.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\system32\cmd.execmd /C net.exe user WgaUtilAcc 000000 /del2⤵
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc 000000 /del3⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc 000000 /del4⤵PID:2192
-
-
-
-
C:\Windows\system32\cmd.execmd /C net.exe user WgaUtilAcc 30NcrQ0m /add2⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc 30NcrQ0m /add3⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc 30NcrQ0m /add4⤵PID:208
-
-
-