Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
32 DEMNADA ...AL.exe
windows7-x64
102 DEMNADA ...AL.exe
windows10-2004-x64
102 DEMNADA ...32.dll
windows7-x64
32 DEMNADA ...32.dll
windows10-2004-x64
32 DEMNADA ...32.dll
windows7-x64
32 DEMNADA ...32.dll
windows10-2004-x64
32 DEMNADA ...ar.dll
windows7-x64
32 DEMNADA ...ar.dll
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
30/08/2024, 16:47
Static task
static1
Behavioral task
behavioral1
Sample
2 DEMNADA LABORAL- JUZGADO 02 CIVIL DEL CIRCUITO RAMA JUDICIAL/1 DEMANADA LABORAL.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2 DEMNADA LABORAL- JUZGADO 02 CIVIL DEL CIRCUITO RAMA JUDICIAL/1 DEMANADA LABORAL.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
2 DEMNADA LABORAL- JUZGADO 02 CIVIL DEL CIRCUITO RAMA JUDICIAL/madHcNet32.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
2 DEMNADA LABORAL- JUZGADO 02 CIVIL DEL CIRCUITO RAMA JUDICIAL/madHcNet32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
2 DEMNADA LABORAL- JUZGADO 02 CIVIL DEL CIRCUITO RAMA JUDICIAL/mvrSettings32.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
2 DEMNADA LABORAL- JUZGADO 02 CIVIL DEL CIRCUITO RAMA JUDICIAL/mvrSettings32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
2 DEMNADA LABORAL- JUZGADO 02 CIVIL DEL CIRCUITO RAMA JUDICIAL/unrar.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
2 DEMNADA LABORAL- JUZGADO 02 CIVIL DEL CIRCUITO RAMA JUDICIAL/unrar.dll
Resource
win10v2004-20240802-en
General
-
Target
2 DEMNADA LABORAL- JUZGADO 02 CIVIL DEL CIRCUITO RAMA JUDICIAL/madHcNet32.dll
-
Size
921KB
-
MD5
d22b9da713ab36102c9c3d812af8c12d
-
SHA1
371fdbf6ae6a9a2e5c0560fc94eba3290028a252
-
SHA256
95b538b47e02d0ad2bd15d47efc18695d5e379ef61568b81ef405773d9c199bb
-
SHA512
e5ae51f79403358af60bb3ea663251badac57414813f5537d763b0b95504a393fb2d34c94c4b7328ec13f58e74a7147d3a72e63e62973c4c5d80671be1c8face
-
SSDEEP
24576:TlUbWq3/gquYUJ4Vgv0eUnDaE0efxfXT95:pUR4quYUJ4VgceXE0gxfjv
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\hardware\description\system\centralProcessor\2 rundll32.exe Key opened \REGISTRY\MACHINE\hardware\description\system\centralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\hardware\description\system\centralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1744 wrote to memory of 1844 1744 rundll32.exe 31 PID 1744 wrote to memory of 1844 1744 rundll32.exe 31 PID 1744 wrote to memory of 1844 1744 rundll32.exe 31 PID 1744 wrote to memory of 1844 1744 rundll32.exe 31 PID 1744 wrote to memory of 1844 1744 rundll32.exe 31 PID 1744 wrote to memory of 1844 1744 rundll32.exe 31 PID 1744 wrote to memory of 1844 1744 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\2 DEMNADA LABORAL- JUZGADO 02 CIVIL DEL CIRCUITO RAMA JUDICIAL\madHcNet32.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\2 DEMNADA LABORAL- JUZGADO 02 CIVIL DEL CIRCUITO RAMA JUDICIAL\madHcNet32.dll",#12⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1844
-