Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 00:04
Static task
static1
Behavioral task
behavioral1
Sample
7c188d1a10d54a2ae7c73edf791fc3eda0091d5c2e417a34d2f2e8703e1e7ff0.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7c188d1a10d54a2ae7c73edf791fc3eda0091d5c2e417a34d2f2e8703e1e7ff0.dll
Resource
win10v2004-20240802-en
General
-
Target
7c188d1a10d54a2ae7c73edf791fc3eda0091d5c2e417a34d2f2e8703e1e7ff0.dll
-
Size
137KB
-
MD5
437dacfde86b74e7192a6171f4f11612
-
SHA1
f4ad766acc5bdb200b4013431fbf1414aaf10053
-
SHA256
7c188d1a10d54a2ae7c73edf791fc3eda0091d5c2e417a34d2f2e8703e1e7ff0
-
SHA512
0f30628a4c31baab7cbb95b11971aa14e199786ac970c21dea939e0df2b5dc1d97ba00d14166b4f6dd3aa116452a2f563ef4a6b9c2bb56fe56d4a7ddd043e498
-
SSDEEP
3072:eR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUua:L25GgFny61mraQ
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor\Driver = "scsimon.dll" rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor rundll32.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Spooler\ImagePath = "Spoolsv.exe" rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\com\comb.dll rundll32.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\AppPatch\ComBack.Dll rundll32.exe File opened for modification C:\Windows\AppPatch\ComBack.Dll rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2352 2072 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4216 wrote to memory of 2072 4216 rundll32.exe 83 PID 4216 wrote to memory of 2072 4216 rundll32.exe 83 PID 4216 wrote to memory of 2072 4216 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7c188d1a10d54a2ae7c73edf791fc3eda0091d5c2e417a34d2f2e8703e1e7ff0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7c188d1a10d54a2ae7c73edf791fc3eda0091d5c2e417a34d2f2e8703e1e7ff0.dll,#12⤵
- Boot or Logon Autostart Execution: Port Monitors
- Sets service image path in registry
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2072 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 6163⤵
- Program crash
PID:2352
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2072 -ip 20721⤵PID:2532