Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28/01/2025, 05:01
Static task
static1
Behavioral task
behavioral1
Sample
f32749877eca9e940ceb6d6ee445e4eee5c526242b714cc4e7c29d7c459a1c7d.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
f32749877eca9e940ceb6d6ee445e4eee5c526242b714cc4e7c29d7c459a1c7d.dll
Resource
win10v2004-20241007-en
General
-
Target
f32749877eca9e940ceb6d6ee445e4eee5c526242b714cc4e7c29d7c459a1c7d.dll
-
Size
137KB
-
MD5
60f3b91184119e7935eb2ec088d366a6
-
SHA1
3df8edabd359b274dd0a242e56f9425c6b2e53f0
-
SHA256
f32749877eca9e940ceb6d6ee445e4eee5c526242b714cc4e7c29d7c459a1c7d
-
SHA512
f5b2f08ef22e5e1914421244b2c6de969509038062a565c30a6f6756ddbb3ae14be8050e07e076e0ba9c8531d40e56459a9e04f1d47968b45195f791d1ddefad
-
SSDEEP
3072:wR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUu:V25GgFny61mra
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor\Driver = "scsimon.dll" rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor rundll32.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Spooler\ImagePath = "Spoolsv.exe" rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\com\comb.dll rundll32.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\AppPatch\ComBack.Dll rundll32.exe File created C:\Windows\AppPatch\ComBack.Dll rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2148 1856 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 796 wrote to memory of 1856 796 rundll32.exe 29 PID 796 wrote to memory of 1856 796 rundll32.exe 29 PID 796 wrote to memory of 1856 796 rundll32.exe 29 PID 796 wrote to memory of 1856 796 rundll32.exe 29 PID 796 wrote to memory of 1856 796 rundll32.exe 29 PID 796 wrote to memory of 1856 796 rundll32.exe 29 PID 796 wrote to memory of 1856 796 rundll32.exe 29 PID 1856 wrote to memory of 2148 1856 rundll32.exe 30 PID 1856 wrote to memory of 2148 1856 rundll32.exe 30 PID 1856 wrote to memory of 2148 1856 rundll32.exe 30 PID 1856 wrote to memory of 2148 1856 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f32749877eca9e940ceb6d6ee445e4eee5c526242b714cc4e7c29d7c459a1c7d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f32749877eca9e940ceb6d6ee445e4eee5c526242b714cc4e7c29d7c459a1c7d.dll,#12⤵
- Boot or Logon Autostart Execution: Port Monitors
- Sets service image path in registry
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 2323⤵
- Program crash
PID:2148
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding1⤵PID:2816