Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/09/2024, 21:07
Static task
static1
Behavioral task
behavioral1
Sample
bdefef2c15c070b8a8311c32e5c72973ecf2b3c26ae59cb47ffe9a7fd30f7cbaN.dll
Resource
win7-20240903-en
General
-
Target
bdefef2c15c070b8a8311c32e5c72973ecf2b3c26ae59cb47ffe9a7fd30f7cbaN.dll
-
Size
93KB
-
MD5
c4f3b9623fadc78ec38f777eed8462e0
-
SHA1
2b7d0cdfa66129f95cde8e2d5a4bcb1017a2a58d
-
SHA256
bdefef2c15c070b8a8311c32e5c72973ecf2b3c26ae59cb47ffe9a7fd30f7cba
-
SHA512
db81d33d08651c9b6e25e1f3bda93fe955e4a79be6658f9c4fe2e1f69ac15c91d756940d7310b3e1fd25e81e55e0957e4b0c722fff3fd740280e09336e7fb279
-
SSDEEP
1536:ImZJdMmJyDl+2BZloWyHjmgVe/z9r3G/qsxS+JZ78cglmH:IIJuIyDPZFyHj9Ve/FDISMZ7
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2432 hrl1C38.tmp 2680 wwgoke.exe -
Loads dropped DLL 3 IoCs
pid Process 2292 rundll32.exe 2292 rundll32.exe 2680 wwgoke.exe -
Enumerates connected drives 3 TTPs 42 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\J: wwgoke.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\U: wwgoke.exe File opened (read-only) \??\X: wwgoke.exe File opened (read-only) \??\G: wwgoke.exe File opened (read-only) \??\I: wwgoke.exe File opened (read-only) \??\K: wwgoke.exe File opened (read-only) \??\Q: wwgoke.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\O: wwgoke.exe File opened (read-only) \??\Y: wwgoke.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\V: wwgoke.exe File opened (read-only) \??\Z: wwgoke.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\E: wwgoke.exe File opened (read-only) \??\P: wwgoke.exe File opened (read-only) \??\W: wwgoke.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\L: wwgoke.exe File opened (read-only) \??\T: wwgoke.exe File opened (read-only) \??\M: wwgoke.exe File opened (read-only) \??\R: wwgoke.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\H: wwgoke.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\N: wwgoke.exe File opened (read-only) \??\S: wwgoke.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\wwgoke.exe hrl1C38.tmp File opened for modification C:\Windows\SysWOW64\wwgoke.exe hrl1C38.tmp File created C:\Windows\SysWOW64\hra33.dll wwgoke.exe -
Drops file in Program Files directory 32 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\lpk.dll wwgoke.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\lpk.dll wwgoke.exe File created C:\Program Files\7-Zip\lpk.dll wwgoke.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\lpk.dll wwgoke.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lpk.dll wwgoke.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\lpk.dll wwgoke.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\lpk.dll wwgoke.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\lpk.dll wwgoke.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\lpk.dll wwgoke.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\lpk.dll wwgoke.exe File created C:\Program Files\Google\Chrome\Application\lpk.dll wwgoke.exe File created C:\Program Files\Internet Explorer\lpk.dll wwgoke.exe File opened for modification C:\Program Files\Internet Explorer\lpk.dll wwgoke.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\lpk.dll wwgoke.exe File opened for modification C:\Program Files\Java\jre7\bin\lpk.dll wwgoke.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\lpk.dll wwgoke.exe File opened for modification C:\Program Files\DVD Maker\lpk.dll wwgoke.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\lpk.dll wwgoke.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\lpk.dll wwgoke.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\lpk.dll wwgoke.exe File created C:\Program Files\Java\jre7\bin\lpk.dll wwgoke.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\lpk.dll wwgoke.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\lpk.dll wwgoke.exe File created C:\Program Files\DVD Maker\lpk.dll wwgoke.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\lpk.dll wwgoke.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\lpk.dll wwgoke.exe File opened for modification C:\Program Files\Google\Chrome\Application\lpk.dll wwgoke.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\lpk.dll wwgoke.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\lpk.dll wwgoke.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\lpk.dll wwgoke.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\lpk.dll wwgoke.exe File opened for modification C:\Program Files\7-Zip\lpk.dll wwgoke.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrl1C38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wwgoke.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2432 hrl1C38.tmp 2680 wwgoke.exe -
Suspicious behavior: MapViewOfSection 51 IoCs
pid Process 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe 2680 wwgoke.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2432 hrl1C38.tmp Token: SeDebugPrivilege 2680 wwgoke.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2432 hrl1C38.tmp 2432 hrl1C38.tmp 2680 wwgoke.exe 2680 wwgoke.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2292 2180 rundll32.exe 29 PID 2180 wrote to memory of 2292 2180 rundll32.exe 29 PID 2180 wrote to memory of 2292 2180 rundll32.exe 29 PID 2180 wrote to memory of 2292 2180 rundll32.exe 29 PID 2180 wrote to memory of 2292 2180 rundll32.exe 29 PID 2180 wrote to memory of 2292 2180 rundll32.exe 29 PID 2180 wrote to memory of 2292 2180 rundll32.exe 29 PID 2292 wrote to memory of 2432 2292 rundll32.exe 30 PID 2292 wrote to memory of 2432 2292 rundll32.exe 30 PID 2292 wrote to memory of 2432 2292 rundll32.exe 30 PID 2292 wrote to memory of 2432 2292 rundll32.exe 30 PID 2432 wrote to memory of 372 2432 hrl1C38.tmp 3 PID 2432 wrote to memory of 372 2432 hrl1C38.tmp 3 PID 2432 wrote to memory of 372 2432 hrl1C38.tmp 3 PID 2432 wrote to memory of 372 2432 hrl1C38.tmp 3 PID 2432 wrote to memory of 372 2432 hrl1C38.tmp 3 PID 2432 wrote to memory of 372 2432 hrl1C38.tmp 3 PID 2432 wrote to memory of 372 2432 hrl1C38.tmp 3 PID 2432 wrote to memory of 384 2432 hrl1C38.tmp 4 PID 2432 wrote to memory of 384 2432 hrl1C38.tmp 4 PID 2432 wrote to memory of 384 2432 hrl1C38.tmp 4 PID 2432 wrote to memory of 384 2432 hrl1C38.tmp 4 PID 2432 wrote to memory of 384 2432 hrl1C38.tmp 4 PID 2432 wrote to memory of 384 2432 hrl1C38.tmp 4 PID 2432 wrote to memory of 384 2432 hrl1C38.tmp 4 PID 2432 wrote to memory of 420 2432 hrl1C38.tmp 5 PID 2432 wrote to memory of 420 2432 hrl1C38.tmp 5 PID 2432 wrote to memory of 420 2432 hrl1C38.tmp 5 PID 2432 wrote to memory of 420 2432 hrl1C38.tmp 5 PID 2432 wrote to memory of 420 2432 hrl1C38.tmp 5 PID 2432 wrote to memory of 420 2432 hrl1C38.tmp 5 PID 2432 wrote to memory of 420 2432 hrl1C38.tmp 5 PID 2432 wrote to memory of 464 2432 hrl1C38.tmp 6 PID 2432 wrote to memory of 464 2432 hrl1C38.tmp 6 PID 2432 wrote to memory of 464 2432 hrl1C38.tmp 6 PID 2432 wrote to memory of 464 2432 hrl1C38.tmp 6 PID 2432 wrote to memory of 464 2432 hrl1C38.tmp 6 PID 2432 wrote to memory of 464 2432 hrl1C38.tmp 6 PID 2432 wrote to memory of 464 2432 hrl1C38.tmp 6 PID 2432 wrote to memory of 480 2432 hrl1C38.tmp 7 PID 2432 wrote to memory of 480 2432 hrl1C38.tmp 7 PID 2432 wrote to memory of 480 2432 hrl1C38.tmp 7 PID 2432 wrote to memory of 480 2432 hrl1C38.tmp 7 PID 2432 wrote to memory of 480 2432 hrl1C38.tmp 7 PID 2432 wrote to memory of 480 2432 hrl1C38.tmp 7 PID 2432 wrote to memory of 480 2432 hrl1C38.tmp 7 PID 2432 wrote to memory of 488 2432 hrl1C38.tmp 8 PID 2432 wrote to memory of 488 2432 hrl1C38.tmp 8 PID 2432 wrote to memory of 488 2432 hrl1C38.tmp 8 PID 2432 wrote to memory of 488 2432 hrl1C38.tmp 8 PID 2432 wrote to memory of 488 2432 hrl1C38.tmp 8 PID 2432 wrote to memory of 488 2432 hrl1C38.tmp 8 PID 2432 wrote to memory of 488 2432 hrl1C38.tmp 8 PID 2432 wrote to memory of 592 2432 hrl1C38.tmp 9 PID 2432 wrote to memory of 592 2432 hrl1C38.tmp 9 PID 2432 wrote to memory of 592 2432 hrl1C38.tmp 9 PID 2432 wrote to memory of 592 2432 hrl1C38.tmp 9 PID 2432 wrote to memory of 592 2432 hrl1C38.tmp 9 PID 2432 wrote to memory of 592 2432 hrl1C38.tmp 9 PID 2432 wrote to memory of 592 2432 hrl1C38.tmp 9 PID 2432 wrote to memory of 672 2432 hrl1C38.tmp 10 PID 2432 wrote to memory of 672 2432 hrl1C38.tmp 10 PID 2432 wrote to memory of 672 2432 hrl1C38.tmp 10 PID 2432 wrote to memory of 672 2432 hrl1C38.tmp 10
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:372
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:592
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:840
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1480
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:672
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:756
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:812
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1216
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:844
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:988
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:284
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:1016
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1032
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1128
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:2040
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1196
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:1592
-
-
C:\Windows\SysWOW64\wwgoke.exeC:\Windows\SysWOW64\wwgoke.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2680
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:480
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:488
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:384
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1268
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bdefef2c15c070b8a8311c32e5c72973ecf2b3c26ae59cb47ffe9a7fd30f7cbaN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bdefef2c15c070b8a8311c32e5c72973ecf2b3c26ae59cb47ffe9a7fd30f7cbaN.dll,#13⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\hrl1C38.tmpC:\Users\Admin\AppData\Local\Temp\hrl1C38.tmp4⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85KB
MD5a1c541bc7c723396464af1a0cd736842
SHA1d1170dedcfe3d11b000f9235e2cd1be43c13e134
SHA2566b762ae5e8f14098e75be421ad71ccd4fde4a8afcbe197bad3648378480b568b
SHA512efeaa0ba159a1fcd365de4f40812b0b1bd3bf906e875262583b4636899096712deefec19375c5f1677dd8dcd0cc14a3b5740bd239c8c965dd4faabedacd2c8c8
-
Filesize
93KB
MD5c4f3b9623fadc78ec38f777eed8462e0
SHA12b7d0cdfa66129f95cde8e2d5a4bcb1017a2a58d
SHA256bdefef2c15c070b8a8311c32e5c72973ecf2b3c26ae59cb47ffe9a7fd30f7cba
SHA512db81d33d08651c9b6e25e1f3bda93fe955e4a79be6658f9c4fe2e1f69ac15c91d756940d7310b3e1fd25e81e55e0957e4b0c722fff3fd740280e09336e7fb279