Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 00:06
Behavioral task
behavioral1
Sample
201036c4387369e63c11a56571f6f540874a5605592db368431ab1e86be76bb2N.dll
Resource
win7-20240708-en
General
-
Target
201036c4387369e63c11a56571f6f540874a5605592db368431ab1e86be76bb2N.dll
-
Size
1.5MB
-
MD5
29fe922e1390597ec7adb9182cb31670
-
SHA1
3610b4e0f739cc3f6f5a775f286e7c84c0450a97
-
SHA256
201036c4387369e63c11a56571f6f540874a5605592db368431ab1e86be76bb2
-
SHA512
3625f64c7272a758902eeb2c2f8f892fb6f434ed1f0b18229f1bc04c8619a332bd1796194264aaed4bf8028c2c5ab1ad6ff1e827d7e050902d02e390c30df788
-
SSDEEP
24576:naM84oHVJQgsGNbBNXjo2dj7MM1ebXh040Uf5GtaudomjI23yvNHm0L4+kMRGJ/s:aM84wL7U2pIM1KhcUf5Gt3db0b491qL
Malware Config
Signatures
-
Floxif family
-
Detects Floxif payload 1 IoCs
resource yara_rule behavioral2/files/0x000c000000023aed-4.dat floxif -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000c000000023aed-4.dat acprotect -
Loads dropped DLL 2 IoCs
pid Process 4912 rundll32.exe 4912 rundll32.exe -
pid Process 3140 arp.exe 1928 arp.exe 3760 arp.exe 2468 arp.exe 4572 arp.exe 1852 arp.exe 4520 arp.exe 4744 arp.exe 804 arp.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rundll32.rpt rundll32.exe File created C:\Windows\SysWOW64\rundll32.dmp rundll32.exe -
resource yara_rule behavioral2/memory/4912-1-0x0000000010000000-0x000000001048E000-memory.dmp upx behavioral2/files/0x000c000000023aed-4.dat upx behavioral2/memory/4912-7-0x0000000002990000-0x00000000029C3000-memory.dmp upx behavioral2/memory/4912-15-0x0000000010000000-0x000000001048E000-memory.dmp upx behavioral2/memory/4912-17-0x0000000002990000-0x00000000029C3000-memory.dmp upx -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1884 4912 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4912 rundll32.exe 4912 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4912 rundll32.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3428 wrote to memory of 4912 3428 rundll32.exe 83 PID 3428 wrote to memory of 4912 3428 rundll32.exe 83 PID 3428 wrote to memory of 4912 3428 rundll32.exe 83 PID 4912 wrote to memory of 3140 4912 rundll32.exe 84 PID 4912 wrote to memory of 3140 4912 rundll32.exe 84 PID 4912 wrote to memory of 3140 4912 rundll32.exe 84 PID 4912 wrote to memory of 4572 4912 rundll32.exe 88 PID 4912 wrote to memory of 4572 4912 rundll32.exe 88 PID 4912 wrote to memory of 4572 4912 rundll32.exe 88 PID 4912 wrote to memory of 804 4912 rundll32.exe 89 PID 4912 wrote to memory of 804 4912 rundll32.exe 89 PID 4912 wrote to memory of 804 4912 rundll32.exe 89 PID 4912 wrote to memory of 4744 4912 rundll32.exe 90 PID 4912 wrote to memory of 4744 4912 rundll32.exe 90 PID 4912 wrote to memory of 4744 4912 rundll32.exe 90 PID 4912 wrote to memory of 2468 4912 rundll32.exe 91 PID 4912 wrote to memory of 2468 4912 rundll32.exe 91 PID 4912 wrote to memory of 2468 4912 rundll32.exe 91 PID 4912 wrote to memory of 3760 4912 rundll32.exe 92 PID 4912 wrote to memory of 3760 4912 rundll32.exe 92 PID 4912 wrote to memory of 3760 4912 rundll32.exe 92 PID 4912 wrote to memory of 1928 4912 rundll32.exe 93 PID 4912 wrote to memory of 1928 4912 rundll32.exe 93 PID 4912 wrote to memory of 1928 4912 rundll32.exe 93 PID 4912 wrote to memory of 4520 4912 rundll32.exe 94 PID 4912 wrote to memory of 4520 4912 rundll32.exe 94 PID 4912 wrote to memory of 4520 4912 rundll32.exe 94 PID 4912 wrote to memory of 1852 4912 rundll32.exe 95 PID 4912 wrote to memory of 1852 4912 rundll32.exe 95 PID 4912 wrote to memory of 1852 4912 rundll32.exe 95
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\201036c4387369e63c11a56571f6f540874a5605592db368431ab1e86be76bb2N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\201036c4387369e63c11a56571f6f540874a5605592db368431ab1e86be76bb2N.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\arp.exearp -a3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3140
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.0.1 1c-dd-d2-9b-49-4f3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4572
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.255.255 d6-af-f4-77-cc-ea3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:804
-
-
C:\Windows\SysWOW64\arp.exearp -s 37.27.61.185 04-1f-f6-02-4f-8e3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4744
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.22 42-d0-cb-88-69-ea3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2468
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.251 a3-ef-53-34-ff-9a3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3760
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.252 32-d9-a4-7d-50-9f3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:1928
-
-
C:\Windows\SysWOW64\arp.exearp -s 239.255.255.250 60-25-da-5b-5d-6c3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4520
-
-
C:\Windows\SysWOW64\arp.exearp -s 255.255.255.255 29-17-74-ac-f7-073⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:1852
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 8843⤵
- Program crash
PID:1884
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4912 -ip 49121⤵PID:4664
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD54fcd7574537cebec8e75b4e646996643
SHA1efa59bb9050fb656b90d5d40c942fb2a304f2a8b
SHA2568ea3b17e4b783ffc0bc387b81b823bf87af0d57da74541d88ba85314bb232a5d
SHA5127f1a7ef64d332a735db82506b47d84853af870785066d29ccaf4fdeab114079a9f0db400e01ba574776a0d652a248658fe1e8f9659cdced19ad6eea09644ea3e