Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18/04/2024, 09:01
Static task
static1
Behavioral task
behavioral1
Sample
357f87f0fc2e9ca9596d8a5545c1fde68511fe7295d0ad9c02f0bfbeb35f2e00.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
357f87f0fc2e9ca9596d8a5545c1fde68511fe7295d0ad9c02f0bfbeb35f2e00.dll
Resource
win10v2004-20240226-en
General
-
Target
357f87f0fc2e9ca9596d8a5545c1fde68511fe7295d0ad9c02f0bfbeb35f2e00.dll
-
Size
397KB
-
MD5
2972f949fbe533cca11780dfa3bdebf7
-
SHA1
1372f1b3ba887523201c089efb2de1d4db63852f
-
SHA256
357f87f0fc2e9ca9596d8a5545c1fde68511fe7295d0ad9c02f0bfbeb35f2e00
-
SHA512
9ab3dd02cdedfdafc390db0f132ce4c04cc87a86ed9c32e4c369f26d02eed8429f78dd3cc5a9899a37cb89ca454120443fdaecf74f77274f476254b6e0a37e22
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa8:174g2LDeiPDImOkx2LIa8
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4548 rundll32.exe Token: SeTcbPrivilege 4548 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2144 wrote to memory of 4548 2144 rundll32.exe 91 PID 2144 wrote to memory of 4548 2144 rundll32.exe 91 PID 2144 wrote to memory of 4548 2144 rundll32.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\357f87f0fc2e9ca9596d8a5545c1fde68511fe7295d0ad9c02f0bfbeb35f2e00.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\357f87f0fc2e9ca9596d8a5545c1fde68511fe7295d0ad9c02f0bfbeb35f2e00.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵PID:2396