Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
63s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
30/12/2024, 15:54
Behavioral task
behavioral1
Sample
4053f3844c8ec0da0da9640aa9aa615541a39f866eb87921554c2d86316aa8d4.dll
Resource
win7-20240729-en
General
-
Target
4053f3844c8ec0da0da9640aa9aa615541a39f866eb87921554c2d86316aa8d4.dll
-
Size
430KB
-
MD5
b23b7c59c73a3ce7d4505c78d11598d1
-
SHA1
9aab260cabedf8a108808d20b76f4225ac2b2965
-
SHA256
4053f3844c8ec0da0da9640aa9aa615541a39f866eb87921554c2d86316aa8d4
-
SHA512
150cd38abfe3432dbdc00ee83d0c59f1c14d61542e0ed349df2ec3144f75c7fc1080e4384c0f9b51bda7143c980fb765865ec4a7a5181de714c367f928d70150
-
SSDEEP
12288:q9j8pWxJdNxnSJwu416c9y0wiL7s1T37AVu68VnogfN7oSG:q9I+dGwu13UVb+n3fNI
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 3 IoCs
resource yara_rule behavioral1/memory/1172-1-0x0000000010000000-0x00000000100FE000-memory.dmp family_blackmoon behavioral1/memory/1172-7-0x0000000010000000-0x00000000100FE000-memory.dmp family_blackmoon behavioral1/memory/1172-16-0x0000000010000000-0x00000000100FE000-memory.dmp family_blackmoon -
resource yara_rule behavioral1/memory/2248-24-0x0000000000400000-0x0000000000543000-memory.dmp purplefox_rootkit behavioral1/memory/2248-23-0x0000000000400000-0x0000000000543000-memory.dmp purplefox_rootkit behavioral1/memory/2248-22-0x0000000010000000-0x00000000101A0000-memory.dmp purplefox_rootkit behavioral1/memory/2248-26-0x0000000010000000-0x00000000101A0000-memory.dmp purplefox_rootkit behavioral1/memory/2248-34-0x0000000000400000-0x0000000000543000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 5 IoCs
resource yara_rule behavioral1/memory/2248-24-0x0000000000400000-0x0000000000543000-memory.dmp family_gh0strat behavioral1/memory/2248-23-0x0000000000400000-0x0000000000543000-memory.dmp family_gh0strat behavioral1/memory/2248-22-0x0000000010000000-0x00000000101A0000-memory.dmp family_gh0strat behavioral1/memory/2248-26-0x0000000010000000-0x00000000101A0000-memory.dmp family_gh0strat behavioral1/memory/2248-34-0x0000000000400000-0x0000000000543000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Executes dropped EXE 1 IoCs
pid Process 2832 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1172 set thread context of 2248 1172 rundll32.exe 31 -
resource yara_rule behavioral1/memory/1172-0-0x0000000010000000-0x00000000100FE000-memory.dmp upx behavioral1/memory/1172-1-0x0000000010000000-0x00000000100FE000-memory.dmp upx behavioral1/memory/2248-19-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral1/memory/2248-21-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral1/memory/2248-3-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral1/memory/2248-5-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral1/memory/1172-7-0x0000000010000000-0x00000000100FE000-memory.dmp upx behavioral1/memory/2248-9-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral1/memory/2248-20-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral1/memory/2248-18-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral1/memory/2248-17-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral1/memory/2248-15-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral1/memory/1172-16-0x0000000010000000-0x00000000100FE000-memory.dmp upx behavioral1/memory/2248-24-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral1/memory/2248-23-0x0000000000400000-0x0000000000543000-memory.dmp upx behavioral1/memory/2248-34-0x0000000000400000-0x0000000000543000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\NetMeeting\svchost.exe svchost.exe File opened for modification C:\Program Files (x86)\NetMeeting\svchost.exe svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2044 cmd.exe 1976 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1976 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2248 svchost.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 528 wrote to memory of 1172 528 rundll32.exe 30 PID 528 wrote to memory of 1172 528 rundll32.exe 30 PID 528 wrote to memory of 1172 528 rundll32.exe 30 PID 528 wrote to memory of 1172 528 rundll32.exe 30 PID 528 wrote to memory of 1172 528 rundll32.exe 30 PID 528 wrote to memory of 1172 528 rundll32.exe 30 PID 528 wrote to memory of 1172 528 rundll32.exe 30 PID 1172 wrote to memory of 2248 1172 rundll32.exe 31 PID 1172 wrote to memory of 2248 1172 rundll32.exe 31 PID 1172 wrote to memory of 2248 1172 rundll32.exe 31 PID 1172 wrote to memory of 2248 1172 rundll32.exe 31 PID 1172 wrote to memory of 2248 1172 rundll32.exe 31 PID 1172 wrote to memory of 2248 1172 rundll32.exe 31 PID 1172 wrote to memory of 2248 1172 rundll32.exe 31 PID 1172 wrote to memory of 2248 1172 rundll32.exe 31 PID 2248 wrote to memory of 2044 2248 svchost.exe 33 PID 2248 wrote to memory of 2044 2248 svchost.exe 33 PID 2248 wrote to memory of 2044 2248 svchost.exe 33 PID 2248 wrote to memory of 2044 2248 svchost.exe 33 PID 2044 wrote to memory of 1976 2044 cmd.exe 35 PID 2044 wrote to memory of 1976 2044 cmd.exe 35 PID 2044 wrote to memory of 1976 2044 cmd.exe 35 PID 2044 wrote to memory of 1976 2044 cmd.exe 35
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4053f3844c8ec0da0da9640aa9aa615541a39f866eb87921554c2d86316aa8d4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4053f3844c8ec0da0da9640aa9aa615541a39f866eb87921554c2d86316aa8d4.dll,#12⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\svchost.exesvchost.exe fagahawhawhgawccc3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Windows\SysWOW64\svchost.exe > nul4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.15⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1976
-
-
-
-
-
C:\Program Files (x86)\NetMeeting\svchost.exe"C:\Program Files (x86)\NetMeeting\svchost.exe" -auto1⤵
- Executes dropped EXE
PID:2832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD554a47f6b5e09a77e61649109c6a08866
SHA14af001b3c3816b860660cf2de2c0fd3c1dfb4878
SHA256121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2
SHA51288ee0ef5af1b0b38c19ab4c307636352fc403ea74f3bfb17e246f7fd815ac042183086133cd9fe805bd47e15854776871bb7d384e419862c91503eeb82bfb419