Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/01/2025, 04:36
Static task
static1
Behavioral task
behavioral1
Sample
e8a3784efe60cee49989ab5e77d489ce1f239f32f3b42931ea3dfae6116988c7.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e8a3784efe60cee49989ab5e77d489ce1f239f32f3b42931ea3dfae6116988c7.dll
Resource
win10v2004-20241007-en
General
-
Target
e8a3784efe60cee49989ab5e77d489ce1f239f32f3b42931ea3dfae6116988c7.dll
-
Size
137KB
-
MD5
a0ed3e3e216e91620979e33c2d1225ad
-
SHA1
e83d6a87c4e7c9138091b0b70596e893082047ca
-
SHA256
e8a3784efe60cee49989ab5e77d489ce1f239f32f3b42931ea3dfae6116988c7
-
SHA512
f70789d11151f85f36f34b88788b06a2ccdef0ccba7219d74a79853131dab58120d3ecacbdde865b918fda8315a2d8722e003269f1c3534630f6a2e07b1dc162
-
SSDEEP
3072:ER02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuo:h25GgFny61mraG
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor\Driver = "scsimon.dll" rundll32.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Spooler\ImagePath = "Spoolsv.exe" rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2196 2516 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2496 wrote to memory of 2516 2496 rundll32.exe 30 PID 2496 wrote to memory of 2516 2496 rundll32.exe 30 PID 2496 wrote to memory of 2516 2496 rundll32.exe 30 PID 2496 wrote to memory of 2516 2496 rundll32.exe 30 PID 2496 wrote to memory of 2516 2496 rundll32.exe 30 PID 2496 wrote to memory of 2516 2496 rundll32.exe 30 PID 2496 wrote to memory of 2516 2496 rundll32.exe 30 PID 2516 wrote to memory of 2196 2516 rundll32.exe 31 PID 2516 wrote to memory of 2196 2516 rundll32.exe 31 PID 2516 wrote to memory of 2196 2516 rundll32.exe 31 PID 2516 wrote to memory of 2196 2516 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e8a3784efe60cee49989ab5e77d489ce1f239f32f3b42931ea3dfae6116988c7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e8a3784efe60cee49989ab5e77d489ce1f239f32f3b42931ea3dfae6116988c7.dll,#12⤵
- Boot or Logon Autostart Execution: Port Monitors
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 2283⤵
- Program crash
PID:2196
-
-