Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 20:32
Static task
static1
Behavioral task
behavioral1
Sample
318d3dd1f88f4ddc6b4ecaab5ea8eefa9959c4f27927b3f00ee014c8a4b3d514.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
318d3dd1f88f4ddc6b4ecaab5ea8eefa9959c4f27927b3f00ee014c8a4b3d514.dll
Resource
win10v2004-20240802-en
General
-
Target
318d3dd1f88f4ddc6b4ecaab5ea8eefa9959c4f27927b3f00ee014c8a4b3d514.dll
-
Size
956KB
-
MD5
d32ccb613f81a139c05de7fad7a76598
-
SHA1
713cb4f51f86cd78fd2aa14696cf272777ee06b8
-
SHA256
318d3dd1f88f4ddc6b4ecaab5ea8eefa9959c4f27927b3f00ee014c8a4b3d514
-
SHA512
60dc859ca497a72bf8cbcc96b57773adb17ddfea4823ede17df2716cee776ffe3cec6ad50cc6b3c95e7540906e700dee930360d8af604f531d4a038f8dd2ddce
-
SSDEEP
24576:YegGLV3oBLAlQ3H18OoyLaH8xHYu6zvUc:YlGLMqQAyLacSdzcc
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 556 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4528 wrote to memory of 556 4528 rundll32.exe 83 PID 4528 wrote to memory of 556 4528 rundll32.exe 83 PID 4528 wrote to memory of 556 4528 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\318d3dd1f88f4ddc6b4ecaab5ea8eefa9959c4f27927b3f00ee014c8a4b3d514.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\318d3dd1f88f4ddc6b4ecaab5ea8eefa9959c4f27927b3f00ee014c8a4b3d514.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:556
-