Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 03:00
Behavioral task
behavioral1
Sample
adb2d6d946f39976de3f5b99d86eb94d8e4345312cc89e010f0851180a7f18b3.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
adb2d6d946f39976de3f5b99d86eb94d8e4345312cc89e010f0851180a7f18b3.dll
Resource
win10v2004-20241007-en
General
-
Target
adb2d6d946f39976de3f5b99d86eb94d8e4345312cc89e010f0851180a7f18b3.dll
-
Size
1.0MB
-
MD5
dd6043fc837d2f087612f35a2553c6c9
-
SHA1
3d663f1323c2999f48fdfbc56b979d71b3e96687
-
SHA256
adb2d6d946f39976de3f5b99d86eb94d8e4345312cc89e010f0851180a7f18b3
-
SHA512
762233e908e32f457539055da920812dd175ce83a1ccaa7a1ae32a10023bd96c28e98d073064564b3f5f054ade74792cd0c7311bf5c0025eed21b1cbc9263889
-
SSDEEP
24576:IWBhVxYlZdJCTgmP/xEcCJnDOEl5woFNEa1mXu5iPajrVT1qnD:IWBhPYrpoCpmX2pjXqnD
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 2064 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
pid Process 4216 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 4220 netsh.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2064 rundll32.exe 2064 rundll32.exe 2064 rundll32.exe 2064 rundll32.exe 2064 rundll32.exe 2064 rundll32.exe 2064 rundll32.exe 2064 rundll32.exe 2064 rundll32.exe 2064 rundll32.exe 2064 rundll32.exe 2064 rundll32.exe 4216 powershell.exe 4216 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4216 powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1932 wrote to memory of 2064 1932 rundll32.exe 83 PID 1932 wrote to memory of 2064 1932 rundll32.exe 83 PID 1932 wrote to memory of 2064 1932 rundll32.exe 83 PID 2064 wrote to memory of 4220 2064 rundll32.exe 84 PID 2064 wrote to memory of 4220 2064 rundll32.exe 84 PID 2064 wrote to memory of 4220 2064 rundll32.exe 84 PID 2064 wrote to memory of 4216 2064 rundll32.exe 86 PID 2064 wrote to memory of 4216 2064 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\adb2d6d946f39976de3f5b99d86eb94d8e4345312cc89e010f0851180a7f18b3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\adb2d6d946f39976de3f5b99d86eb94d8e4345312cc89e010f0851180a7f18b3.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4220
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\437139445115_Desktop.zip' -CompressionLevel Optimal3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4216
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD546f7eea2c8582f75425c1d9a6da7c151
SHA1e9ba8c4f660e731d70d136fa0ec54875acc81318
SHA256770676f0601a51882603e3c25ce69f6c2ccffdc876f4186a4474cc0e24f6b09a
SHA5124e156f9184cec20c04e6b8f4b2a853bd058d99528db0b44c6847603c1a0711204c18c2b597b253bbb4c450c22a8ec8e7744098856b2854e343f97153d8725ae3
-
Filesize
9KB
MD5bdd225d9e39e11bb3aa48e17500dfcc4
SHA19705ba94a816812c633d3f33ddc0f4fe581addb6
SHA256d3fd57fd927e10afa81be991e99229270c6454fba18469ad8a34ef94e4ad4de9
SHA512a03bca7f50a04080dc92c3f996b4801424a5bffe06f20fd8addc68c29f1f30f7f068c73976536891337514ad12a4b09ce1cc0c3b739fdb48b89bb4bb7ce06967
-
Filesize
11KB
MD5becda62356c8addca82f6e8195434861
SHA1b53a699806c05f96ac86b77344862368cbe27804
SHA25634cca6eda9681e7fe8d4680ca43ef6be72372ec5c91d79f863aa7b825e6a139f
SHA51206906e7997bdbf2b596d18a3c99a5a2b90fae0d43f8f9c1a781690db662a3c1fa488cd5e6ab27ee873d232dd56f23f4d2d2b9eea4f89e2c0473738f2152410b1
-
Filesize
11KB
MD5b331134e88f9c279e5da00544d5d5f3f
SHA1aaa967920f52808abf03adee4928e2c2922234dd
SHA256f072c9f3371847f543d15bf8b8250fdf947db6ea2b9ca5710fc292760f13a67d
SHA51261bccaf5ab59c2360c84a9ba8595ad71bde68ef050083a011f2789538ae3d1e064c486e0a137c64249b9f8031107b9acdec1e9bd6e8b7a40478f50fc20059df2
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82