Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
140s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
23/07/2024, 15:20 UTC
General
-
Target
NursultanNextgen2024/lwjgl_stb.dll
-
Size
102KB
-
MD5
b5ee40662104194eb904fd559d5e781e
-
SHA1
224a48ab7ba6fcdbf684ca841d059c9bd297376e
-
SHA256
2865f9df4a6635135fe40029e43e76e11287c2deb30e4b023c7acbfd896aca58
-
SHA512
35f61a019be990ab65316e03ca6de3691426da1d232d1caf90e0d8dcc3c020a7c6db13207fbbbad74b39b653740594a26a8038c43ce1d478c17090209b75962c
-
SSDEEP
1536:CqP4/ysXsu3E2BuY/5dCFegxqN9BBJ5QBJXM+ETV4JJARDeQfLpcI:C5/GYRdfBJ5QBJ7lC7La
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NursultanNextgen2024\lwjgl_stb.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NursultanNextgen2024\lwjgl_stb.dll,#12⤵
- System Location Discovery: System Language Discovery
-
Network
-
DNS13.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse -
DNS73.144.22.2.in-addr.arpaRemote address:8.8.8.8:53Request73.144.22.2.in-addr.arpaIN PTRResponse73.144.22.2.in-addr.arpaIN PTRa2-22-144-73deploystaticakamaitechnologiescom
-
DNS131.72.42.20.in-addr.arpaRemote address:8.8.8.8:53Request131.72.42.20.in-addr.arpaIN PTRResponse
-
52.111.229.48:443
-
8.8.8.8:5313.227.111.52.in-addr.arpadns
DNS Request
13.227.111.52.in-addr.arpa
-
8.8.8.8:5373.144.22.2.in-addr.arpadns
DNS Request
73.144.22.2.in-addr.arpa
-
8.8.8.8:53131.72.42.20.in-addr.arpadns
DNS Request
131.72.42.20.in-addr.arpa