Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
06/06/2024, 08:55
Static task
static1
Behavioral task
behavioral1
Sample
QtCore4.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
QtCore4.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
QtGui4.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
QtGui4.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
chrome.exe
Resource
win7-20240508-en
General
-
Target
QtGui4.dll
-
Size
6.8MB
-
MD5
ddd7cb6f7fcb04a7a22b8c88e54960c4
-
SHA1
ec90b7dc14ba83b31557262f9f4694478cbb751a
-
SHA256
ed88922666a2323c05c08c75f7ad29d049d1a36399ab988ad5ce1e86149cb450
-
SHA512
0e6d046c4f4e5fab3bc0aea57a99f0a1779f7fb4a3950f0e302b65ef411c9a08c534607f1be9533fa82ea64be5a5391c28b5ab615de82680188e2b1d28c8fc07
-
SSDEEP
196608:AEubw71Hqi7SVzQlgj2bMWE+LpoMk+dTha46Yuy7uNcK:AEuERKoukwmLlJdThxcZ7
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2372 rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1328 2372 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2372 3000 rundll32.exe 28 PID 3000 wrote to memory of 2372 3000 rundll32.exe 28 PID 3000 wrote to memory of 2372 3000 rundll32.exe 28 PID 3000 wrote to memory of 2372 3000 rundll32.exe 28 PID 3000 wrote to memory of 2372 3000 rundll32.exe 28 PID 3000 wrote to memory of 2372 3000 rundll32.exe 28 PID 3000 wrote to memory of 2372 3000 rundll32.exe 28 PID 2372 wrote to memory of 1328 2372 rundll32.exe 29 PID 2372 wrote to memory of 1328 2372 rundll32.exe 29 PID 2372 wrote to memory of 1328 2372 rundll32.exe 29 PID 2372 wrote to memory of 1328 2372 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\QtGui4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\QtGui4.dll,#12⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 3203⤵
- Program crash
PID:1328
-
-