Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
01/08/2024, 21:33
Static task
static1
Behavioral task
behavioral1
Sample
063a1fd511d90658cb1079e47702e670N.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
063a1fd511d90658cb1079e47702e670N.dll
Resource
win10v2004-20240730-en
General
-
Target
063a1fd511d90658cb1079e47702e670N.dll
-
Size
736KB
-
MD5
063a1fd511d90658cb1079e47702e670
-
SHA1
69b2b59069c8ac76d146ff69dbc6b978abf424af
-
SHA256
640ee9b20243c566ca3666d33f41b3f845ce12809af0f91b56e57932d553cb14
-
SHA512
748ffbc892f576294b12f80a37f78c5b5c7a64a2a85a27f6640521f1702804e8e6e4e22a502e94f72e1e98f248cc3800b6374efa189644d92387315268caf1ba
-
SSDEEP
12288:HlQXHbjkbigibQM1wh0Azn/NtY0uTg9H6aGnZxqYj52qd+DZeo7tEoHT90bF+04d:FQrjkbigiscATNtuTWaZx8qoDZBuz4Yo
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2140 wrote to memory of 2080 2140 rundll32.exe 30 PID 2140 wrote to memory of 2080 2140 rundll32.exe 30 PID 2140 wrote to memory of 2080 2140 rundll32.exe 30 PID 2140 wrote to memory of 2080 2140 rundll32.exe 30 PID 2140 wrote to memory of 2080 2140 rundll32.exe 30 PID 2140 wrote to memory of 2080 2140 rundll32.exe 30 PID 2140 wrote to memory of 2080 2140 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1fd511d90658cb1079e47702e670N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\063a1fd511d90658cb1079e47702e670N.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2080
-