Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    15s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    27/07/2024, 23:46

General

  • Target

    $PROGRAMFILES/SoftForum/XecureWeb/AnySign/cert/libnspr4.dll

  • Size

    204KB

  • MD5

    7957e822b5e67afe2cb64e1fbfc923db

  • SHA1

    49e065f2ebc213c445e8c637b32f101674ca4dc8

  • SHA256

    480c54abd5c555520ee38069d9233b1c2739286471376a56ee66bd756a37fde2

  • SHA512

    ed44cc693175c01e1d1a7b856ca800e3cd641a3f434ffecd1532324111aa55010601c1aa92ce069133c012d6e89d5b99bd9526283da9b972b53f788a820e63bb

  • SSDEEP

    3072:AtiZp9HzAEvs0thsMy0jHWkN+IsQ5kPGd+pEbqxvh50SyvHerJu8g:sGp9HMEvsqsQHBsQ5kPGd+pEevVyv8

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\SoftForum\XecureWeb\AnySign\cert\libnspr4.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:408
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\SoftForum\XecureWeb\AnySign\cert\libnspr4.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads