Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 01:14
Static task
static1
Behavioral task
behavioral1
Sample
30d27ff95354ee56096e7f06f5eb0f64d895c996f6ff8e45c781f1c14b542373.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
30d27ff95354ee56096e7f06f5eb0f64d895c996f6ff8e45c781f1c14b542373.dll
Resource
win10v2004-20240802-en
General
-
Target
30d27ff95354ee56096e7f06f5eb0f64d895c996f6ff8e45c781f1c14b542373.dll
-
Size
3.4MB
-
MD5
5289d05b6525f474898a5541ff32adfd
-
SHA1
7a3d784e4f737786b54a177c80275a91ee7076c2
-
SHA256
30d27ff95354ee56096e7f06f5eb0f64d895c996f6ff8e45c781f1c14b542373
-
SHA512
1a06e5c4eee0097d9795a8dbfb866e0db0427a9b01c28f1a7035f4d854a05e802a832b4f30f2e608b36231f1ad5fb68637ca3d108ef330d55059080b751d7075
-
SSDEEP
98304:Uv98fGTl6Cy5XAtd9D+5p4w0GE7aGtUM:Uv92R5X+FBIGtT
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2572 2368 rundll32.exe 30 PID 2368 wrote to memory of 2572 2368 rundll32.exe 30 PID 2368 wrote to memory of 2572 2368 rundll32.exe 30 PID 2368 wrote to memory of 2572 2368 rundll32.exe 30 PID 2368 wrote to memory of 2572 2368 rundll32.exe 30 PID 2368 wrote to memory of 2572 2368 rundll32.exe 30 PID 2368 wrote to memory of 2572 2368 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\30d27ff95354ee56096e7f06f5eb0f64d895c996f6ff8e45c781f1c14b542373.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\30d27ff95354ee56096e7f06f5eb0f64d895c996f6ff8e45c781f1c14b542373.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2572
-