Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3The Henry ...IR.dll
windows7-x64
3The Henry ...IR.dll
windows10-2004-x64
3The Henry ...15.dll
windows7-x64
3The Henry ...15.dll
windows10-2004-x64
3The Henry ...ry.exe
windows7-x64
3The Henry ...ry.exe
windows10-2004-x64
3The Henry ...32.dll
windows7-x64
3The Henry ...32.dll
windows10-2004-x64
3The Henry ...64.dll
windows7-x64
1The Henry ...64.dll
windows10-2004-x64
1The Henry ...it.dll
windows7-x64
3The Henry ...it.dll
windows10-2004-x64
3The Henry ...cp.dll
windows7-x64
3The Henry ...cp.dll
windows10-2004-x64
3The Henry ...in.exe
windows7-x64
3The Henry ...in.exe
windows10-2004-x64
3The Henry ...NF.dll
windows7-x64
3The Henry ...NF.dll
windows10-2004-x64
3The Henry ...pi.dll
windows7-x64
3The Henry ...pi.dll
windows10-2004-x64
3Analysis
-
max time kernel
425s -
max time network
450s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 10:07
Static task
static1
Behavioral task
behavioral1
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Adobe AIR.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Adobe AIR.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/AdobeCP15.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/AdobeCP15.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/CaptiveAppEntry.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/CaptiveAppEntry.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/NPSWF32.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/NPSWF32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/NPSWF64.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/NPSWF64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/WebKit.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/WebKit.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/adobecp.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/adobecp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
The Henry Stickmin Collection/HenryStickmin.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
The Henry Stickmin Collection/HenryStickmin.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
The Henry Stickmin Collection/META-INF/AIR/extensions/com.amanitadesign.steam.FRESteamWorks/META-INF.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
The Henry Stickmin Collection/META-INF/AIR/extensions/com.amanitadesign.steam.FRESteamWorks/META-INF.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
The Henry Stickmin Collection/steam_api.dll
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
The Henry Stickmin Collection/steam_api.dll
Resource
win10v2004-20240802-en
General
-
Target
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/AdobeCP15.dll
-
Size
3.3MB
-
MD5
64a91e9ea17910657f8a7eaae7a4afd0
-
SHA1
c6e8637b6a5e11bd69b6d6a1742df4fc612fc08b
-
SHA256
6fcf417f525f29eb89243afdf82a97f9e85fb468e042b0f87cb6fc68d8933901
-
SHA512
0cfe0f26f345e9ae52c5fdb05a852d6b02aa6b1f0f1a17310e7d02885ace7cd52a26bbf9e4df8618242823282f499e3f162430abd218685649409b0c7f8b8805
-
SSDEEP
98304:XcYiLP9WspdG83NSXFx4irHUFEHbICfJZ37AYTXGsc:XcZLPjrG83NSXFx4irHUFEHbIQJZ8yW3
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3716 wrote to memory of 1148 3716 rundll32.exe 85 PID 3716 wrote to memory of 1148 3716 rundll32.exe 85 PID 3716 wrote to memory of 1148 3716 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\The Henry Stickmin Collection\Adobe AIR\Versions\1.0\Resources\AdobeCP15.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\The Henry Stickmin Collection\Adobe AIR\Versions\1.0\Resources\AdobeCP15.dll",#12⤵
- System Location Discovery: System Language Discovery
PID:1148
-