Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
52s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
10/08/2024, 05:46
Static task
static1
Behavioral task
behavioral1
Sample
DD94687.32.dll
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
RhythmSharp.exe
Resource
win11-20240802-en
General
-
Target
RhythmSharp.exe
-
Size
8.7MB
-
MD5
ec457adeb9d86e97aad64744f46b0c5c
-
SHA1
e23058322c1ef34439b5a44db923228a497b76f6
-
SHA256
6d6f27074a5c75b16fa8e3446b15564a4a2ea30dd0b8d3474bc4067ce25214db
-
SHA512
7eb61432ee35dfe535f1ae0e8950066e83a476f1f64ac14eb0bad339202cc801b841a09e547014b3b588abffcc1bda0dafe1c13f7d8b891a8de0d1f2f8f6f1a3
-
SSDEEP
98304:tAMYxRNs9CB62DEDuUWFRaIbDy1w8Xm/XmM:adNL6JE9m1HW/X
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RhythmSharp.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe 5080 RhythmSharp.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 664 Process not Found -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5080 RhythmSharp.exe