Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
6s -
platform
windows7_x64 -
resource
win7-20240704-en -
submitted
11/08/2024, 08:24
Behavioral task
behavioral1
Sample
fagality.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
fagality.dll
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
fagality.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
fagality.dll
Resource
win11-20240802-en
General
-
Target
fagality.dll
-
Size
36.2MB
-
MD5
36a3ff324f2fe1a9e71f40bf575c936c
-
SHA1
f1ef1d289021000c2f742e7b38518bb0fdbde905
-
SHA256
74a00336a08201483ce04dc30891b077b614cd5023336efac17a5aaa9ddd8b8e
-
SHA512
d4a3753e3261239a45ff54091274c4eafda834387eb7221bd0aa6b6a2d8170f9ba68d07c623903a562ef5f07aff51bfbc214bc93771396027ebba2c1a0e06b2d
-
SSDEEP
393216:w/SBskEyrtN+zJkGsF20dH5ZXtpKjzw1QxgvLqmNAmjpy:UArtN+zJkGsF2OZZXuv4GcLjp
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2140 1924 rundll32.exe 30 PID 1924 wrote to memory of 2140 1924 rundll32.exe 30 PID 1924 wrote to memory of 2140 1924 rundll32.exe 30 PID 1924 wrote to memory of 2140 1924 rundll32.exe 30 PID 1924 wrote to memory of 2140 1924 rundll32.exe 30 PID 1924 wrote to memory of 2140 1924 rundll32.exe 30 PID 1924 wrote to memory of 2140 1924 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fagality.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fagality.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2140
-