Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2024, 11:20
Static task
static1
Behavioral task
behavioral1
Sample
7b44bcbc214c78715d0f590b1635dfa9.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7b44bcbc214c78715d0f590b1635dfa9.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/fzltxxnfffs.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/fzltxxnfffs.dll
Resource
win10v2004-20240802-en
General
-
Target
$PLUGINSDIR/fzltxxnfffs.dll
-
Size
194KB
-
MD5
c1ee8fc3cb583c07338524ac89801344
-
SHA1
041872fd3d00b10c7983f641be1e579bb709e6b7
-
SHA256
2b1efdc452245df048688e006a8d7c103e5ec369cab07125060161752ea6d8b6
-
SHA512
bd59b363d5c6e01a5f92e17f3c8c86eda4793a7ca53fa062aa80632fdb2130df527991ceb3ac6f73edd09e22a8e71968d0b7ad6e50fb7a7f2f9ed417f82f0190
-
SSDEEP
6144:ZUtJEr7mQNzZ/vDXqxnfNahvFp1cck4X3rm6v:ZnCYFD6TG9pjni6v
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2704 4792 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4308 wrote to memory of 4792 4308 rundll32.exe 84 PID 4308 wrote to memory of 4792 4308 rundll32.exe 84 PID 4308 wrote to memory of 4792 4308 rundll32.exe 84 PID 4792 wrote to memory of 4524 4792 rundll32.exe 85 PID 4792 wrote to memory of 4524 4792 rundll32.exe 85 PID 4792 wrote to memory of 4524 4792 rundll32.exe 85 PID 4792 wrote to memory of 4524 4792 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fzltxxnfffs.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fzltxxnfffs.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fzltxxnfffs.dll,#13⤵PID:4524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 7283⤵
- Program crash
PID:2704
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4792 -ip 47921⤵PID:1492