Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3bootstrap.zip
windows7-x64
1bootstrap.zip
windows10-2004-x64
8bootstrap/...er.exe
windows7-x64
10bootstrap/...er.exe
windows10-2004-x64
10bootstrap/...64.dll
windows7-x64
1bootstrap/...64.dll
windows10-2004-x64
6bootstrap/...10.dll
windows7-x64
1bootstrap/...10.dll
windows10-2004-x64
8bootstrap/...11.dll
windows7-x64
1bootstrap/...11.dll
windows10-2004-x64
8bootstrap/...64.dll
windows7-x64
10bootstrap/...64.dll
windows10-2004-x64
10Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
09/02/2025, 21:31
Static task
static1
Behavioral task
behavioral1
Sample
bootstrap.zip
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
bootstrap.zip
Resource
win10v2004-20250207-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
bootstrap/bootstrapper.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
bootstrap/bootstrapper.exe
Resource
win10v2004-20250207-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
bootstrap/tier0_s64.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
bootstrap/tier0_s64.dll
Resource
win10v2004-20250207-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
bootstrap/vcruntime210.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
bootstrap/vcruntime210.dll
Resource
win10v2004-20250207-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
bootstrap/vcruntime211.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral10
Sample
bootstrap/vcruntime211.dll
Resource
win10v2004-20250207-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
bootstrap/vstdlib_s64.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral12
Sample
bootstrap/vstdlib_s64.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
General
-
Target
bootstrap/vstdlib_s64.dll
-
Size
3.2MB
-
MD5
2af311d5fdb8df6250ee6681edea15bb
-
SHA1
68cea60147b29ae47fd18d97698e9bcf6f713c36
-
SHA256
c1cd2c6fd3c17d9e67ec45436064b911f2dc81fb2c32ece5ef9878b8af35dda5
-
SHA512
b20a08a1690dac97c456acc1cd8bfe01b3310c490abee3063a5189f45e28e0ac116f313524b9ca5003b84e2cc07c090e28a9fa9240fa3e4f03d9cf1fe00240de
-
SSDEEP
49152:wSN5WWMbW0m7Dng+arKHXKS2n4qBJ9X1LaYztS:FV4546S2n4Q9Fh
Malware Config
Signatures
-
Detects Rhadamanthys payload 1 IoCs
resource yara_rule behavioral11/memory/2824-3-0x0000000000400000-0x0000000000481000-memory.dmp Rhadamanthys_v8 -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Rhadamanthys family
-
Enumerates VirtualBox registry keys 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe -
Looks for VMWare services registry key. 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL rundll32.exe -
Uses the VBS compiler for execution 1 TTPs
-
Runs regedit.exe 1 IoCs
pid Process 2736 regedit.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2848 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2848 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2824 2848 rundll32.exe 30 PID 2848 wrote to memory of 2824 2848 rundll32.exe 30 PID 2848 wrote to memory of 2824 2848 rundll32.exe 30 PID 2848 wrote to memory of 2824 2848 rundll32.exe 30 PID 2848 wrote to memory of 2824 2848 rundll32.exe 30 PID 2848 wrote to memory of 2824 2848 rundll32.exe 30 PID 2848 wrote to memory of 3000 2848 rundll32.exe 31 PID 2848 wrote to memory of 3000 2848 rundll32.exe 31 PID 2848 wrote to memory of 3000 2848 rundll32.exe 31 PID 2848 wrote to memory of 3000 2848 rundll32.exe 31 PID 2848 wrote to memory of 3000 2848 rundll32.exe 31 PID 2848 wrote to memory of 3000 2848 rundll32.exe 31 PID 2848 wrote to memory of 3016 2848 rundll32.exe 32 PID 2848 wrote to memory of 3016 2848 rundll32.exe 32 PID 2848 wrote to memory of 3016 2848 rundll32.exe 32 PID 2848 wrote to memory of 3016 2848 rundll32.exe 32 PID 2848 wrote to memory of 2572 2848 rundll32.exe 33 PID 2848 wrote to memory of 2572 2848 rundll32.exe 33 PID 2848 wrote to memory of 2572 2848 rundll32.exe 33 PID 2848 wrote to memory of 2572 2848 rundll32.exe 33 PID 2848 wrote to memory of 2572 2848 rundll32.exe 33 PID 2848 wrote to memory of 2572 2848 rundll32.exe 33 PID 2848 wrote to memory of 2900 2848 rundll32.exe 34 PID 2848 wrote to memory of 2900 2848 rundll32.exe 34 PID 2848 wrote to memory of 2900 2848 rundll32.exe 34 PID 2848 wrote to memory of 2900 2848 rundll32.exe 34 PID 2848 wrote to memory of 2464 2848 rundll32.exe 35 PID 2848 wrote to memory of 2464 2848 rundll32.exe 35 PID 2848 wrote to memory of 2464 2848 rundll32.exe 35 PID 2848 wrote to memory of 2464 2848 rundll32.exe 35 PID 2848 wrote to memory of 2464 2848 rundll32.exe 35 PID 2848 wrote to memory of 2864 2848 rundll32.exe 36 PID 2848 wrote to memory of 2864 2848 rundll32.exe 36 PID 2848 wrote to memory of 2864 2848 rundll32.exe 36 PID 2848 wrote to memory of 2864 2848 rundll32.exe 36 PID 2848 wrote to memory of 2864 2848 rundll32.exe 36 PID 2848 wrote to memory of 2748 2848 rundll32.exe 37 PID 2848 wrote to memory of 2748 2848 rundll32.exe 37 PID 2848 wrote to memory of 2748 2848 rundll32.exe 37 PID 2848 wrote to memory of 2748 2848 rundll32.exe 37 PID 2848 wrote to memory of 2748 2848 rundll32.exe 37 PID 2848 wrote to memory of 2688 2848 rundll32.exe 38 PID 2848 wrote to memory of 2688 2848 rundll32.exe 38 PID 2848 wrote to memory of 2688 2848 rundll32.exe 38 PID 2848 wrote to memory of 2688 2848 rundll32.exe 38 PID 2848 wrote to memory of 2688 2848 rundll32.exe 38 PID 2848 wrote to memory of 2756 2848 rundll32.exe 39 PID 2848 wrote to memory of 2756 2848 rundll32.exe 39 PID 2848 wrote to memory of 2756 2848 rundll32.exe 39 PID 2848 wrote to memory of 2756 2848 rundll32.exe 39 PID 2848 wrote to memory of 2756 2848 rundll32.exe 39 PID 2848 wrote to memory of 2756 2848 rundll32.exe 39 PID 2848 wrote to memory of 2552 2848 rundll32.exe 40 PID 2848 wrote to memory of 2552 2848 rundll32.exe 40 PID 2848 wrote to memory of 2552 2848 rundll32.exe 40 PID 2848 wrote to memory of 2552 2848 rundll32.exe 40 PID 2848 wrote to memory of 2552 2848 rundll32.exe 40 PID 2848 wrote to memory of 2552 2848 rundll32.exe 40 PID 2848 wrote to memory of 2736 2848 rundll32.exe 41 PID 2848 wrote to memory of 2736 2848 rundll32.exe 41 PID 2848 wrote to memory of 2736 2848 rundll32.exe 41 PID 2848 wrote to memory of 2736 2848 rundll32.exe 41 PID 2848 wrote to memory of 2736 2848 rundll32.exe 41 PID 2848 wrote to memory of 2620 2848 rundll32.exe 42
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bootstrap\vstdlib_s64.dll,#11⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare services registry key.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"2⤵PID:2824
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵PID:3000
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"2⤵PID:3016
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:2572
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"2⤵PID:2900
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:2464
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"2⤵PID:2864
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2748
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:2688
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"2⤵PID:2756
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵PID:2552
-
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe"2⤵
- Runs regedit.exe
PID:2736
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵PID:2620
-