Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10BouncyCast...to.dll
windows7-x64
1BouncyCast...to.dll
windows10-2004-x64
1BurndownExt.dll
windows7-x64
3BurndownExt.dll
windows10-2004-x64
3Calendar.DayView.dll
windows7-x64
1Calendar.DayView.dll
windows10-2004-x64
1CalendarExt.dll
windows7-x64
3CalendarExt.dll
windows10-2004-x64
3CommandHandling.dll
windows7-x64
1CommandHandling.dll
windows10-2004-x64
1ConvertRTFToHTML.exe
windows7-x64
3ConvertRTFToHTML.exe
windows10-2004-x64
3CustomComboBox.dll
windows7-x64
1CustomComboBox.dll
windows10-2004-x64
1DayViewUIE...ge.dll
windows7-x64
3DayViewUIE...ge.dll
windows10-2004-x64
3DayViewUIE...re.dll
windows7-x64
3DayViewUIE...re.dll
windows10-2004-x64
3EncryptDecrypt.dll
windows7-x64
3EncryptDecrypt.dll
windows10-2004-x64
3EvidenceBo...ge.dll
windows7-x64
3EvidenceBo...ge.dll
windows10-2004-x64
3EvidenceBo...re.dll
windows7-x64
3EvidenceBo...re.dll
windows10-2004-x64
3FMindImportExport.dll
windows7-x64
3FMindImportExport.dll
windows10-2004-x64
3FtpStorage.dll
windows7-x64
3FtpStorage.dll
windows10-2004-x64
3GPExport.dll
windows7-x64
3GPExport.dll
windows10-2004-x64
3GanttChartExt.dll
windows7-x64
3GanttChartExt.dll
windows10-2004-x64
3Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 17:11
Static task
static1
Behavioral task
behavioral1
Sample
BouncyCastle.Crypto.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
BouncyCastle.Crypto.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
BurndownExt.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
BurndownExt.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Calendar.DayView.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
Calendar.DayView.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
CalendarExt.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
CalendarExt.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
CommandHandling.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
CommandHandling.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
ConvertRTFToHTML.exe
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
ConvertRTFToHTML.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
CustomComboBox.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
CustomComboBox.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
DayViewUIExtensionBridge.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
DayViewUIExtensionBridge.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
DayViewUIExtensionCore.dll
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
DayViewUIExtensionCore.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
EncryptDecrypt.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
EncryptDecrypt.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
EvidenceBoardUIExtensionBridge.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
EvidenceBoardUIExtensionBridge.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
EvidenceBoardUIExtensionCore.dll
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
EvidenceBoardUIExtensionCore.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
FMindImportExport.dll
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
FMindImportExport.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
FtpStorage.dll
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
FtpStorage.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
GPExport.dll
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
GPExport.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
GanttChartExt.dll
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
GanttChartExt.dll
Resource
win10v2004-20240802-en
General
-
Target
BurndownExt.dll
-
Size
372KB
-
MD5
716ddf2e670abcc2233b7e52199e9c04
-
SHA1
4e4f39f1bf3be3014ba903e640415c6698ceaafa
-
SHA256
adcc0d7535443ee153c7ac1d7f63404a98593d40c4bf5af4da348157b9529313
-
SHA512
9c1a0d344fc60fd5984f27d0953e4bf1f827d9e26c945476367d44ba45f73fd3869d5adc5c0d292654b311ab959634120f2e0240371b4a415e4416e29b6dddc6
-
SSDEEP
6144:MB1w/jvPqDtYes3jXBJzGcjGkaH9jBD80oLSf:MB0jveYeSjBGVHE0Z
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3000 wrote to memory of 1172 3000 rundll32.exe 85 PID 3000 wrote to memory of 1172 3000 rundll32.exe 85 PID 3000 wrote to memory of 1172 3000 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\BurndownExt.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\BurndownExt.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1172
-