Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    201s
  • max time network
    201s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/09/2024, 03:46

General

  • Target

    13092024_0346_tz3.dll

  • Size

    1.8MB

  • MD5

    6dc0d350d735fd1acc8219cfa5d02b9b

  • SHA1

    7ba0708a4404715fb21a23acfbd88a25b7245ef1

  • SHA256

    2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061

  • SHA512

    99c9b6310363ce3a7d9ff680c4a0ae976553fc4789b12f9b60d9f629608d90cf4d64b4c8a037264f8aaa48fba69ae397236ef4c32c2eb6779fb5d9e0b3b0d52f

  • SSDEEP

    24576:jn6mclQ1O/p0g/9fTeVB1SATDqj2/lDRa+QR6P3r3dl60NWEEk6d:jnhclke0wfoHSASyNNFI6P3rNlHNp

Score
10/10

Malware Config

Signatures

  • Detects Latrodectus 7 IoCs

    Detects Latrodectus v1.4.

  • Latrodectus loader

    Latrodectus is a loader written in C++.

  • Blocklisted process makes network request 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\13092024_0346_tz3.dll,#1
    1⤵
    • Deletes itself
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Windows\system32\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_bdcf548b.dll", #1
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      PID:2348
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {253DE16E-3B42-4BCA-B388-89222308796E} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2764
    • C:\Windows\system32\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_bdcf548b.dll", #1
      2⤵
      • Loads dropped DLL
      PID:2612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Custom_update\Update_bdcf548b.dll

    Filesize

    1.8MB

    MD5

    6dc0d350d735fd1acc8219cfa5d02b9b

    SHA1

    7ba0708a4404715fb21a23acfbd88a25b7245ef1

    SHA256

    2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061

    SHA512

    99c9b6310363ce3a7d9ff680c4a0ae976553fc4789b12f9b60d9f629608d90cf4d64b4c8a037264f8aaa48fba69ae397236ef4c32c2eb6779fb5d9e0b3b0d52f

  • memory/2072-0-0x0000000001D40000-0x0000000001D56000-memory.dmp

    Filesize

    88KB

  • memory/2072-3-0x0000000001D40000-0x0000000001D56000-memory.dmp

    Filesize

    88KB

  • memory/2072-1-0x0000000001D40000-0x0000000001D56000-memory.dmp

    Filesize

    88KB

  • memory/2072-6-0x0000000001D40000-0x0000000001D56000-memory.dmp

    Filesize

    88KB

  • memory/2072-4-0x0000000180000000-0x00000001801DC000-memory.dmp

    Filesize

    1.9MB

  • memory/2348-11-0x00000000003E0000-0x00000000003F6000-memory.dmp

    Filesize

    88KB

  • memory/2348-12-0x00000000003E0000-0x00000000003F6000-memory.dmp

    Filesize

    88KB

  • memory/2348-13-0x00000000003E0000-0x00000000003F6000-memory.dmp

    Filesize

    88KB