Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 06:20
Static task
static1
Behavioral task
behavioral1
Sample
cf52ea9d621dca6f64563eb8e09182f9b8e2afc1e6d97eab66bed940167aad7b.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
cf52ea9d621dca6f64563eb8e09182f9b8e2afc1e6d97eab66bed940167aad7b.dll
Resource
win10v2004-20240426-en
General
-
Target
cf52ea9d621dca6f64563eb8e09182f9b8e2afc1e6d97eab66bed940167aad7b.dll
-
Size
223KB
-
MD5
b5127110a2c465bbca75c218b63f1d2e
-
SHA1
1630765496366e35e61fba2a8d30639c2a2682b5
-
SHA256
cf52ea9d621dca6f64563eb8e09182f9b8e2afc1e6d97eab66bed940167aad7b
-
SHA512
f4fe06854edc07da63fece0ab2950ee1ee20433d709334fa2ffc64d39d20193cefc6b25e562d0ff5da2a6a7d356f520d4e451c6ce328224f0c1a06c7a303c1d4
-
SSDEEP
3072:6huf5AUWGIcvWJvK2aguyJZdlGZxIOtY81fs2lQBV+UdE+rECWp7hK+:ZBAUWGOVaguyWLIBV+UdvrEFp7hK+
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000d00000001226b-1.dat acprotect -
Loads dropped DLL 2 IoCs
pid Process 1452 rundll32.exe 2064 WerFault.exe -
resource yara_rule behavioral1/files/0x000d00000001226b-1.dat upx behavioral1/memory/1452-3-0x00000000000C0000-0x00000000000F0000-memory.dmp upx behavioral1/memory/1452-7-0x00000000000C0000-0x00000000000F0000-memory.dmp upx -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2064 1452 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1452 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2984 wrote to memory of 1452 2984 rundll32.exe 28 PID 2984 wrote to memory of 1452 2984 rundll32.exe 28 PID 2984 wrote to memory of 1452 2984 rundll32.exe 28 PID 2984 wrote to memory of 1452 2984 rundll32.exe 28 PID 2984 wrote to memory of 1452 2984 rundll32.exe 28 PID 2984 wrote to memory of 1452 2984 rundll32.exe 28 PID 2984 wrote to memory of 1452 2984 rundll32.exe 28 PID 1452 wrote to memory of 2064 1452 rundll32.exe 29 PID 1452 wrote to memory of 2064 1452 rundll32.exe 29 PID 1452 wrote to memory of 2064 1452 rundll32.exe 29 PID 1452 wrote to memory of 2064 1452 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf52ea9d621dca6f64563eb8e09182f9b8e2afc1e6d97eab66bed940167aad7b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf52ea9d621dca6f64563eb8e09182f9b8e2afc1e6d97eab66bed940167aad7b.dll,#12⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 3323⤵
- Loads dropped DLL
- Program crash
PID:2064
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab