Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
87s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 15:37
Static task
static1
Behavioral task
behavioral1
Sample
26c1bdfed569159ce8ade627e1ae7f49ac27735482e5e67956bc875e9ebe8a38N.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
26c1bdfed569159ce8ade627e1ae7f49ac27735482e5e67956bc875e9ebe8a38N.dll
Resource
win10v2004-20241007-en
General
-
Target
26c1bdfed569159ce8ade627e1ae7f49ac27735482e5e67956bc875e9ebe8a38N.dll
-
Size
137KB
-
MD5
6104d88fe032378df850355ad139cbd0
-
SHA1
f0302259f1a1c23905a36127d744b426967b2023
-
SHA256
26c1bdfed569159ce8ade627e1ae7f49ac27735482e5e67956bc875e9ebe8a38
-
SHA512
633c328daf49778ad55a73df6be6c85fa7fd7eaa5629b9936642404867fe66bf1374e5d03a37dd8b3120b680cf8909b1c25928323054a150411955ea046fc28f
-
SSDEEP
3072:8R02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuX:J25GgFny61mraZ
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor\Driver = "scsimon.dll" rundll32.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Spooler\ImagePath = "Spoolsv.exe" rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\com\comb.dll rundll32.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\AppPatch\ComBack.Dll rundll32.exe File created C:\Windows\AppPatch\ComBack.Dll rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2904 2900 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2612 wrote to memory of 2900 2612 rundll32.exe 31 PID 2612 wrote to memory of 2900 2612 rundll32.exe 31 PID 2612 wrote to memory of 2900 2612 rundll32.exe 31 PID 2612 wrote to memory of 2900 2612 rundll32.exe 31 PID 2612 wrote to memory of 2900 2612 rundll32.exe 31 PID 2612 wrote to memory of 2900 2612 rundll32.exe 31 PID 2612 wrote to memory of 2900 2612 rundll32.exe 31 PID 2900 wrote to memory of 2904 2900 rundll32.exe 32 PID 2900 wrote to memory of 2904 2900 rundll32.exe 32 PID 2900 wrote to memory of 2904 2900 rundll32.exe 32 PID 2900 wrote to memory of 2904 2900 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\26c1bdfed569159ce8ade627e1ae7f49ac27735482e5e67956bc875e9ebe8a38N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\26c1bdfed569159ce8ade627e1ae7f49ac27735482e5e67956bc875e9ebe8a38N.dll,#12⤵
- Boot or Logon Autostart Execution: Port Monitors
- Sets service image path in registry
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 2283⤵
- Program crash
PID:2904
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding1⤵PID:1988