Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    12s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    14/08/2024, 09:53

General

  • Target

    $PLUGINSDIR/InstallOptions.dll

  • Size

    13KB

  • MD5

    72862ffef9009b6fb8612da1ad0a5c6d

  • SHA1

    c11ac4e0ec4da3045bcd8f13a2f316091e44a960

  • SHA256

    4d9256ed7156a541a336f44b9fac8ef9e5b5b787abbbc68297b455a79d2bfdbe

  • SHA512

    796ba8d70c7373275b5e4ed0a5a1f91e0809b65e2a942c56cad9f7e941c62e24608c924c53a6fac4b1431cdcf24d9f8e15b8356dd085098706b16d947330bc40

  • SSDEEP

    192:1znbcLwcLP4wuoId0pdafRbUjuNey3YG/1vpEcDFC1Ac1W:17bWLw3IsJojEey3YMpEcDF

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2556
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1648
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 248
        3⤵
        • Program crash
        PID:2712

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads