Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Apocalуps...se.exe
windows7-x64
1Apocalуps...se.exe
windows10-2004-x64
10Apocalуps...ig.dll
windows7-x64
3Apocalуps...ig.dll
windows10-2004-x64
3Apocalуps...ct.dll
windows7-x64
1Apocalуps...ct.dll
windows10-2004-x64
1Apocalуps...in.dll
windows7-x64
3Apocalуps...in.dll
windows10-2004-x64
3Apocalуps...nu.dll
windows7-x64
1Apocalуps...nu.dll
windows10-2004-x64
1Apocalуps...up.dll
windows7-x64
3Apocalуps...up.dll
windows10-2004-x64
3Apocalуps...wh.dll
windows7-x64
1Apocalуps...wh.dll
windows10-2004-x64
1Apocalуpsе/Core.dll
windows7-x64
1Apocalуpsе/Core.dll
windows10-2004-x64
1Apocalуpsе/Data.dll
windows7-x64
1Apocalуpsе/Data.dll
windows10-2004-x64
1Apocalуps...ng.dll
windows7-x64
1Apocalуps...ng.dll
windows10-2004-x64
1Analysis
-
max time kernel
134s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 16:03
Static task
static1
Behavioral task
behavioral1
Sample
Apocalуpsе/Apocalypse.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Apocalуpsе/Apocalypse.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Apocalуpsе/Configs/config.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Apocalуpsе/Configs/config.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Apocalуpsе/Configs/inject.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Apocalуpsе/Configs/inject.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Apocalуpsе/Configs/main.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
Apocalуpsе/Configs/main.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Apocalуpsе/Configs/menu.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
Apocalуpsе/Configs/menu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Apocalуpsе/Configs/up.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Apocalуpsе/Configs/up.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Apocalуpsе/Configs/wh.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Apocalуpsе/Configs/wh.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Apocalуpsе/Core.dll
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
Apocalуpsе/Core.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Apocalуpsе/Data.dll
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
Apocalуpsе/Data.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Apocalуpsе/Drawing.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
Apocalуpsе/Drawing.dll
Resource
win10v2004-20240802-en
General
-
Target
Apocalуpsе/Configs/main.dll
-
Size
740KB
-
MD5
f643e6ddd7afeed1c03ca69a8e71b66a
-
SHA1
a2c6655ead23c3c4dea9171c5aff4adfeb15ea47
-
SHA256
5733dc037491e1fbbd639131ee462afb69a8fe10680e72a240eed268878bdac4
-
SHA512
ad599fbeac0fdbd86ab6e2395c3d82a589e66bdfbef24870122580da4aaf534d610425da8cc82181b326b0fcb65972957c2e74430f6f950c1bc3cdc0da93671f
-
SSDEEP
12288:ab+Azqyc+GYIvPc/90guuCPzhDAQuoBmbW65dH580JAy0J7IRdwhS4O04htM1D5:ab5Wyc+GYmc0guuEtMQxmbW0dH580xY/
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2624 5832 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5924 wrote to memory of 5832 5924 rundll32.exe 85 PID 5924 wrote to memory of 5832 5924 rundll32.exe 85 PID 5924 wrote to memory of 5832 5924 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Apocalуpsе\Configs\main.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Apocalуpsе\Configs\main.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:5832 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 7723⤵
- Program crash
PID:2624
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5832 -ip 58321⤵PID:4452