Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3The Henry ...IR.dll
windows7-x64
3The Henry ...IR.dll
windows10-2004-x64
3The Henry ...15.dll
windows7-x64
3The Henry ...15.dll
windows10-2004-x64
3The Henry ...ry.exe
windows7-x64
3The Henry ...ry.exe
windows10-2004-x64
3The Henry ...32.dll
windows7-x64
3The Henry ...32.dll
windows10-2004-x64
3The Henry ...64.dll
windows7-x64
1The Henry ...64.dll
windows10-2004-x64
1The Henry ...it.dll
windows7-x64
3The Henry ...it.dll
windows10-2004-x64
3The Henry ...cp.dll
windows7-x64
3The Henry ...cp.dll
windows10-2004-x64
3The Henry ...in.exe
windows7-x64
3The Henry ...in.exe
windows10-2004-x64
3The Henry ...NF.dll
windows7-x64
3The Henry ...NF.dll
windows10-2004-x64
3The Henry ...pi.dll
windows7-x64
3The Henry ...pi.dll
windows10-2004-x64
3Analysis
-
max time kernel
359s -
max time network
373s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 10:07
Static task
static1
Behavioral task
behavioral1
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Adobe AIR.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Adobe AIR.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/AdobeCP15.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/AdobeCP15.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/CaptiveAppEntry.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/CaptiveAppEntry.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/NPSWF32.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/NPSWF32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/NPSWF64.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/NPSWF64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/WebKit.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/WebKit.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/adobecp.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/adobecp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
The Henry Stickmin Collection/HenryStickmin.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
The Henry Stickmin Collection/HenryStickmin.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
The Henry Stickmin Collection/META-INF/AIR/extensions/com.amanitadesign.steam.FRESteamWorks/META-INF.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
The Henry Stickmin Collection/META-INF/AIR/extensions/com.amanitadesign.steam.FRESteamWorks/META-INF.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
The Henry Stickmin Collection/steam_api.dll
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
The Henry Stickmin Collection/steam_api.dll
Resource
win10v2004-20240802-en
General
-
Target
The Henry Stickmin Collection/Adobe AIR/Versions/1.0/Resources/NPSWF32.dll
-
Size
45KB
-
MD5
cb3140c7124595bbda8fb813ce5bf026
-
SHA1
c5bed48ba3edca248e662fd84d4514d8a6149895
-
SHA256
b99a91d965af4e4941a26ae785713e12bb86f010d1adc6079bdd3ffdc896a69d
-
SHA512
c1cd119462ba4366f81c8ed0547b2238fd353eefa4b58a5433bcafc6e23c01d63aac51032a1208e1ad42d44e9cfbd52924474f38043efa518659ad855c3daec6
-
SSDEEP
384:ce61wzgQcJSIumB3DHlctUWDfKCdzH7/z3ZsHLkOgRPnh9L5I:ceYEtIlzmthDfK2foRgdh9Lu
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2516 1712 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1716 wrote to memory of 1712 1716 rundll32.exe 31 PID 1716 wrote to memory of 1712 1716 rundll32.exe 31 PID 1716 wrote to memory of 1712 1716 rundll32.exe 31 PID 1716 wrote to memory of 1712 1716 rundll32.exe 31 PID 1716 wrote to memory of 1712 1716 rundll32.exe 31 PID 1716 wrote to memory of 1712 1716 rundll32.exe 31 PID 1716 wrote to memory of 1712 1716 rundll32.exe 31 PID 1712 wrote to memory of 2516 1712 rundll32.exe 32 PID 1712 wrote to memory of 2516 1712 rundll32.exe 32 PID 1712 wrote to memory of 2516 1712 rundll32.exe 32 PID 1712 wrote to memory of 2516 1712 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\The Henry Stickmin Collection\Adobe AIR\Versions\1.0\Resources\NPSWF32.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\The Henry Stickmin Collection\Adobe AIR\Versions\1.0\Resources\NPSWF32.dll",#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 2243⤵
- Program crash
PID:2516
-
-