Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
12/12/2024, 19:10
241212-xvd6aswmep 1025/08/2024, 14:17
240825-rl7tcsycpe 1025/08/2024, 14:10
240825-rgzbeszdqj 10Analysis
-
max time kernel
6s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
25/08/2024, 14:17
Behavioral task
behavioral1
Sample
0b9fbfd66ba0b70991e0693bff0cb830N.dll
Resource
win10-20240404-en
General
-
Target
0b9fbfd66ba0b70991e0693bff0cb830N.dll
-
Size
76KB
-
MD5
0b9fbfd66ba0b70991e0693bff0cb830
-
SHA1
b7633e9752c25bc4657e6c7bfc5471be4b1bc990
-
SHA256
0b4aaf7e289c11ee0cfd88e834806bd5c6e52afffa3eed0c56b40972fde82cab
-
SHA512
9826df8cbfa7db6bbc510bd364b0ed7a2c42a431bec6076a5b6874de559f1a8879eda2149de372c31edd0261e49304ce66f9f09b59bf090605b21cbf7f1933ac
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Zq7/YPA:c8y93KQjy7G55riF1cMo03iN
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
resource yara_rule behavioral1/memory/2320-0-0x0000000010000000-0x0000000010030000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2320 rundll32.exe 2320 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2320 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3408 wrote to memory of 2320 3408 rundll32.exe 72 PID 3408 wrote to memory of 2320 3408 rundll32.exe 72 PID 3408 wrote to memory of 2320 3408 rundll32.exe 72
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0b9fbfd66ba0b70991e0693bff0cb830N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0b9fbfd66ba0b70991e0693bff0cb830N.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2320
-