Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10BouncyCast...to.dll
windows7-x64
1BouncyCast...to.dll
windows10-2004-x64
1BurndownExt.dll
windows7-x64
3BurndownExt.dll
windows10-2004-x64
3Calendar.DayView.dll
windows7-x64
1Calendar.DayView.dll
windows10-2004-x64
1CalendarExt.dll
windows7-x64
3CalendarExt.dll
windows10-2004-x64
3CommandHandling.dll
windows7-x64
1CommandHandling.dll
windows10-2004-x64
1ConvertRTFToHTML.exe
windows7-x64
3ConvertRTFToHTML.exe
windows10-2004-x64
3CustomComboBox.dll
windows7-x64
1CustomComboBox.dll
windows10-2004-x64
1DayViewUIE...ge.dll
windows7-x64
3DayViewUIE...ge.dll
windows10-2004-x64
3DayViewUIE...re.dll
windows7-x64
3DayViewUIE...re.dll
windows10-2004-x64
3EncryptDecrypt.dll
windows7-x64
3EncryptDecrypt.dll
windows10-2004-x64
3EvidenceBo...ge.dll
windows7-x64
3EvidenceBo...ge.dll
windows10-2004-x64
3EvidenceBo...re.dll
windows7-x64
3EvidenceBo...re.dll
windows10-2004-x64
3FMindImportExport.dll
windows7-x64
3FMindImportExport.dll
windows10-2004-x64
3FtpStorage.dll
windows7-x64
3FtpStorage.dll
windows10-2004-x64
3GPExport.dll
windows7-x64
3GPExport.dll
windows10-2004-x64
3GanttChartExt.dll
windows7-x64
3GanttChartExt.dll
windows10-2004-x64
3Analysis
-
max time kernel
95s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 17:11
Static task
static1
Behavioral task
behavioral1
Sample
BouncyCastle.Crypto.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
BouncyCastle.Crypto.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
BurndownExt.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
BurndownExt.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Calendar.DayView.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
Calendar.DayView.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
CalendarExt.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
CalendarExt.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
CommandHandling.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
CommandHandling.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
ConvertRTFToHTML.exe
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
ConvertRTFToHTML.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
CustomComboBox.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
CustomComboBox.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
DayViewUIExtensionBridge.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
DayViewUIExtensionBridge.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
DayViewUIExtensionCore.dll
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
DayViewUIExtensionCore.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
EncryptDecrypt.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
EncryptDecrypt.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
EvidenceBoardUIExtensionBridge.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
EvidenceBoardUIExtensionBridge.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
EvidenceBoardUIExtensionCore.dll
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
EvidenceBoardUIExtensionCore.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
FMindImportExport.dll
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
FMindImportExport.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
FtpStorage.dll
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
FtpStorage.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
GPExport.dll
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
GPExport.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
GanttChartExt.dll
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
GanttChartExt.dll
Resource
win10v2004-20240802-en
General
-
Target
CalendarExt.dll
-
Size
356KB
-
MD5
c17467514fc9788c65b6b4105c1f6f6b
-
SHA1
3e8dbc3cf0db6fba94cf6723bace96a372fb8619
-
SHA256
081a891776ba3fe26108c3d3bbd5aa7b6736a3bfbe0cbb6ecdc1344fbc55c10c
-
SHA512
e1e9cee20d900ed89270464a61c3624cb8ff8d4e63dbf83ef42f37203a759eb313844ad3541d044162171a29015e16213f6139a17d860fcd6baa1a0171b20b82
-
SSDEEP
6144:xrnZwuUVuRKx7LfkYKB8nqF9HKWEuA40VgLwAnpddu:PwuUswcYQiAHKWE7VgM+ddu
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5116 wrote to memory of 4556 5116 rundll32.exe 85 PID 5116 wrote to memory of 4556 5116 rundll32.exe 85 PID 5116 wrote to memory of 4556 5116 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\CalendarExt.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\CalendarExt.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4556
-