Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 20:50

General

  • Target

    New folder (10)/bin/ArticDLL.dll

  • Size

    9.2MB

  • MD5

    602aa90fe7c3d3dd958d041a28c01cf2

  • SHA1

    a2cbc3bde48d8d764917dde1b56146e4a7a51a1f

  • SHA256

    9f57c170461a90629a3a54149011ddffb321ba17ce6c5a2ad29dd3f953479499

  • SHA512

    c756b3576bd77e6bb4eaaa886a6292b6edb3861d7865aa9f17359e1b071b7adf74ab2ffaf8e66b8f15948ae18e744273b9c3c233c0569362774bf78ca4e554d9

  • SSDEEP

    196608:IDPZpEhP272r1ZULbBw+CjVrLqr/C0dnbX7Hv0vwJLt2IBFS2mSeIN:lhPZBGLbEF+r/Ck8v2LEIPp

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\New folder (10)\bin\ArticDLL.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\New folder (10)\bin\ArticDLL.dll",#1
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:2380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2380-0-0x0000000010000000-0x0000000011642000-memory.dmp

    Filesize

    22.3MB

  • memory/2380-1-0x0000000077B24000-0x0000000077B26000-memory.dmp

    Filesize

    8KB

  • memory/2380-2-0x0000000010000000-0x0000000011642000-memory.dmp

    Filesize

    22.3MB

  • memory/2380-3-0x0000000010000000-0x0000000011642000-memory.dmp

    Filesize

    22.3MB

  • memory/2380-4-0x0000000010000000-0x0000000011642000-memory.dmp

    Filesize

    22.3MB

  • memory/2380-6-0x0000000010000000-0x0000000011642000-memory.dmp

    Filesize

    22.3MB