Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/12/2024, 06:36
Static task
static1
Behavioral task
behavioral1
Sample
dc37a2af60f12ecda1fbbc6832c5698991d2338f031ef5dbf3a2a087e8013135.dll
Resource
win7-20241010-en
General
-
Target
dc37a2af60f12ecda1fbbc6832c5698991d2338f031ef5dbf3a2a087e8013135.dll
-
Size
123KB
-
MD5
a95005da2a9050f277ee7711f04abf3b
-
SHA1
c815c7b19933c43225019a0b8a9a10b4a3d92bbd
-
SHA256
dc37a2af60f12ecda1fbbc6832c5698991d2338f031ef5dbf3a2a087e8013135
-
SHA512
d6e2a962e2705432dd3424c737229a455c147f72a8b9a7252274b1272a1479447e35dc3f22669d1c840cf3acbe8270169b2f87a0c7def9bc4a0db045a260af07
-
SSDEEP
3072:Mdud0eNZxxZsQvVqRlkM4OAD/KLznBuB2JA2BjiU9:MduVNZ9sQvMRlkM4RD/qzMfU9
Malware Config
Signatures
-
Floxif family
-
Detects Floxif payload 1 IoCs
resource yara_rule behavioral2/files/0x000c000000023b23-1.dat floxif -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000c000000023b23-1.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 3032 rundll32.exe -
pid Process 3420 arp.exe 548 arp.exe 2280 arp.exe 4224 arp.exe 220 arp.exe 3068 arp.exe 4820 arp.exe 4604 arp.exe 3272 arp.exe -
resource yara_rule behavioral2/files/0x000c000000023b23-1.dat upx behavioral2/memory/3032-3-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/3032-8-0x0000000010000000-0x0000000010033000-memory.dmp upx -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2124 3032 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3032 rundll32.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4928 wrote to memory of 3032 4928 rundll32.exe 82 PID 4928 wrote to memory of 3032 4928 rundll32.exe 82 PID 4928 wrote to memory of 3032 4928 rundll32.exe 82 PID 3032 wrote to memory of 2280 3032 rundll32.exe 83 PID 3032 wrote to memory of 2280 3032 rundll32.exe 83 PID 3032 wrote to memory of 2280 3032 rundll32.exe 83 PID 3032 wrote to memory of 548 3032 rundll32.exe 87 PID 3032 wrote to memory of 548 3032 rundll32.exe 87 PID 3032 wrote to memory of 548 3032 rundll32.exe 87 PID 3032 wrote to memory of 3420 3032 rundll32.exe 88 PID 3032 wrote to memory of 3420 3032 rundll32.exe 88 PID 3032 wrote to memory of 3420 3032 rundll32.exe 88 PID 3032 wrote to memory of 4820 3032 rundll32.exe 89 PID 3032 wrote to memory of 4820 3032 rundll32.exe 89 PID 3032 wrote to memory of 4820 3032 rundll32.exe 89 PID 3032 wrote to memory of 3272 3032 rundll32.exe 90 PID 3032 wrote to memory of 3272 3032 rundll32.exe 90 PID 3032 wrote to memory of 3272 3032 rundll32.exe 90 PID 3032 wrote to memory of 3068 3032 rundll32.exe 91 PID 3032 wrote to memory of 3068 3032 rundll32.exe 91 PID 3032 wrote to memory of 3068 3032 rundll32.exe 91 PID 3032 wrote to memory of 4604 3032 rundll32.exe 92 PID 3032 wrote to memory of 4604 3032 rundll32.exe 92 PID 3032 wrote to memory of 4604 3032 rundll32.exe 92 PID 3032 wrote to memory of 220 3032 rundll32.exe 93 PID 3032 wrote to memory of 220 3032 rundll32.exe 93 PID 3032 wrote to memory of 220 3032 rundll32.exe 93 PID 3032 wrote to memory of 4224 3032 rundll32.exe 94 PID 3032 wrote to memory of 4224 3032 rundll32.exe 94 PID 3032 wrote to memory of 4224 3032 rundll32.exe 94
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dc37a2af60f12ecda1fbbc6832c5698991d2338f031ef5dbf3a2a087e8013135.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dc37a2af60f12ecda1fbbc6832c5698991d2338f031ef5dbf3a2a087e8013135.dll,#12⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\arp.exearp -a3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2280
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.0.1 d3-bd-f5-4c-e3-e13⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:548
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.255.255 43-d8-e0-c5-4a-363⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3420
-
-
C:\Windows\SysWOW64\arp.exearp -s 136.243.69.123 2f-7f-9a-4f-1d-7a3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4820
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.22 46-86-48-9e-51-f63⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3272
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.251 84-ee-07-82-5a-0c3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3068
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.252 52-ad-d1-1b-e7-d23⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4604
-
-
C:\Windows\SysWOW64\arp.exearp -s 239.255.255.250 67-92-5d-bd-21-243⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:220
-
-
C:\Windows\SysWOW64\arp.exearp -s 255.255.255.255 4a-e8-15-6e-a1-7e3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 7123⤵
- Program crash
PID:2124
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3032 -ip 30321⤵PID:624
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD54fcd7574537cebec8e75b4e646996643
SHA1efa59bb9050fb656b90d5d40c942fb2a304f2a8b
SHA2568ea3b17e4b783ffc0bc387b81b823bf87af0d57da74541d88ba85314bb232a5d
SHA5127f1a7ef64d332a735db82506b47d84853af870785066d29ccaf4fdeab114079a9f0db400e01ba574776a0d652a248658fe1e8f9659cdced19ad6eea09644ea3e