Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
02/06/2024, 22:45
General
-
Target
6210798e6ca0e95300f15c7c12320f40906e2d27a76bc5f566d2023e4d96c3de.dll
-
Size
1.1MB
-
MD5
272c86de56ce13b606e24559924cd686
-
SHA1
74adcabba5d9e796bbd76cf5d986a75f644ce8fc
-
SHA256
6210798e6ca0e95300f15c7c12320f40906e2d27a76bc5f566d2023e4d96c3de
-
SHA512
5a75586c7a22ac1ea249615c9305c90128777ff08e9b2a626da253d946763558ca203a69ed89bb2f69ad50a1aef7206a878f0685d92063213a32348994ad548c
-
SSDEEP
6144:Mi05kH9OyU2uv5SRf/FWgFgtdgqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukTV:nrHGPv5SmpteDmUWuVZkxikdXcqNr
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 14 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 34 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6210798e6ca0e95300f15c7c12320f40906e2d27a76bc5f566d2023e4d96c3de.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\newdev.exeC:\Windows\system32\newdev.exe1⤵
-
C:\Windows\system32\grpconv.exeC:\Windows\system32\grpconv.exe1⤵
-
C:\Windows\system32\bootim.exeC:\Windows\system32\bootim.exe1⤵
-
C:\Windows\system32\cleanmgr.exeC:\Windows\system32\cleanmgr.exe1⤵
-
C:\Windows\system32\rdrleakdiag.exeC:\Windows\system32\rdrleakdiag.exe1⤵
-
C:\Windows\system32\TSTheme.exeC:\Windows\system32\TSTheme.exe1⤵
-
C:\Windows\system32\winver.exeC:\Windows\system32\winver.exe1⤵
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\XSA0D.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{35f320fa-3d67-9dff-e346-2c697e2fb343}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{35f320fa-3d67-9dff-e346-2c697e2fb343}"2⤵
-
-
C:\Windows\system32\cleanmgr.exeC:\Windows\system32\cleanmgr.exe1⤵
-
C:\Windows\system32\dxgiadaptercache.exeC:\Windows\system32\dxgiadaptercache.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\k48CHg5.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\BjC.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Jactb" /SC minute /MO 60 /TR "C:\Windows\system32\8034\dxgiadaptercache.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132B
MD5ab4d6bcc4cf578096c0ecdc380a5d43d
SHA1efa9415adb3467efc3c17d7d90cc1d8a02af066a
SHA256ea0d2ee9f1f6e0eb220aa4cebe7202870f4bb7d8a290489acb780be77b44f0f2
SHA512f732d7a0a105303732c9fb45d7c6b4d1ebb41b2dcd33c8ccb2eb3f0d85637e70eeea3af5ee8c85b32b982e379dd73053d5e0c8c72d625f584f1afc76fd2a176e
-
Filesize
232B
MD5890c913631fbaeb1ee809f90de1b0591
SHA14129ebbad916cca5f203acb8fc2a53103c7ff181
SHA2567362f16cbe16df7d9d2e2afe44bd5ab8a8a32af0296887674c955ebadf1060d8
SHA5128b52d35230b15699679e89a67361f7d37e1b7bfe8093eab2b92f32ee6747ce1867675efd6b09d49bf10b2e98f036de32d08db5948b29439d962a07a30da5f9e0
-
Filesize
200B
MD5fa5f1c8ad0dcde78ebea2751aca8a8a4
SHA1f8f34de5b2efbba8342ff2693c4f9b88b563784e
SHA25611eded72a5080abd12f3a595c613a790ca2cedbdbe9a83e917d5de73e8a6a6e1
SHA5125a7336a8d718341fa5c842e3527a8cb180084c2d885c68bb9e543ab3f3cb6b7d622a52d50ae065f84f5e7785fbde68ba922e98bee8a3e152ff8addd787cf5a68
-
Filesize
1.1MB
MD59bacdcb7768ba0b13843d9d726a9456d
SHA159687089d92d860d9bf17abf1c0f2590bba3917e
SHA25686b248bde22fba6851e543375d8e71d23dd0c6bba5dc76c2bbf04ac4e495e813
SHA5125834543542385ec178d03549bb299f19ae003effb364402a87b5e5e8b83b23939342318eebbdf14b3ab10c64be332ce85507594038e89bb0aaba3df04a581a7c
-
Filesize
1.1MB
MD5e48f607cc94154148d2046c34aa28821
SHA1cc17ae79c6bdc1b847caf9ae6820687289c7eeb7
SHA25631d883ee2b4e09d16cb65ce02ef09e836a1bae4e666717383e3995e2ef9855e1
SHA5129fe768b1ae7fdf3aaeb1808aedcb49786d9eed14cd38cab41a750ed74945915faf3d6c698c8905109e4634a0e59dedf353ae0d6bc2f364924df728d095fa6aaa
-
Filesize
790KB
MD5d3db14eabb2679e08020bcd0c96fa9f6
SHA1578dca7aad29409634064579d269e61e1f07d9dd
SHA2563baa1dc0756ebb0c2c70a31be7147863d8d8ba056c1aa7f979307f8790d1ff69
SHA51214dc895ae458ff0ca13d9c27aa5b4cfc906d338603d43389bb5f4429be593a587818855d1fe938f9ebebf46467fb0c1ab28247e8f9f5357098e8b822ecd8fffe
-
Filesize
904B
MD500b4d8d0b18abf685b98c876844202d0
SHA18f8ef570dc39848447eaedfc14d8bcffff794833
SHA25674379a653a0db02e00624bc323eb48c45077e79f4eb7d45845ff93a13c704ede
SHA5120598fb8ee426bb790d09d69ccbd506888d5f2ce30fa104e8eac310d835043feb80bfdef0b8ec692fd2c3b5617bb73523a41b6d6c384b2803242875ae83fa80ee
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB