Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1amd64_netf...im.dll
windows7-x64
1amd64_netf...im.dll
windows10-2004-x64
1amd64_netf...rf.dll
windows7-x64
1amd64_netf...rf.dll
windows10-2004-x64
1amd64_netf...ee.dll
windows7-x64
1amd64_netf...ee.dll
windows10-2004-x64
1amd64_netf...es.dll
windows7-x64
1amd64_netf...es.dll
windows10-2004-x64
1amd64_wpf-...st.exe
windows7-x64
1amd64_wpf-...st.exe
windows10-2004-x64
1amd64_wpf-...xy.dll
windows7-x64
7amd64_wpf-...xy.dll
windows10-2004-x64
7x86_netfx-...im.dll
windows7-x64
3x86_netfx-...im.dll
windows10-2004-x64
3x86_netfx-...rf.dll
windows7-x64
3x86_netfx-...rf.dll
windows10-2004-x64
3x86_netfx-...ee.dll
windows7-x64
3x86_netfx-...ee.dll
windows10-2004-x64
3x86_netfx-...es.dll
windows7-x64
1x86_netfx-...es.dll
windows10-2004-x64
1x86_wpf-pr...st.exe
windows7-x64
3x86_wpf-pr...st.exe
windows10-2004-x64
3x86_wpf-pr...xy.dll
windows7-x64
3x86_wpf-pr...xy.dll
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 05:15
Static task
static1
Behavioral task
behavioral1
Sample
amd64_netfx-dfshim_dll_31bf3856ad364e35_6.1.6001.18242_none_9ca423e8b4415204/dfshim.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
amd64_netfx-dfshim_dll_31bf3856ad364e35_6.1.6001.18242_none_9ca423e8b4415204/dfshim.dll
Resource
win10v2004-20240910-en
Behavioral task
behavioral3
Sample
amd64_netfx-fw_netfxperf_dll_31bf3856ad364e35_6.1.6001.18242_none_b8b7d5fad28075e7/netfxperf.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
amd64_netfx-fw_netfxperf_dll_31bf3856ad364e35_6.1.6001.18242_none_b8b7d5fad28075e7/netfxperf.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
amd64_netfx-mscoree_dll_31bf3856ad364e35_6.1.6001.18242_none_d984299dad710f1b/mscoree.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
amd64_netfx-mscoree_dll_31bf3856ad364e35_6.1.6001.18242_none_d984299dad710f1b/mscoree.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
amd64_netfx-mscorees_dll_31bf3856ad364e35_6.1.6001.18242_none_3d7db7b9e274d6c8/mscorees.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
amd64_netfx-mscorees_dll_31bf3856ad364e35_6.1.6001.18242_none_3d7db7b9e274d6c8/mscorees.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
amd64_wpf-presentationhostexe_31bf3856ad364e35_6.1.6001.18242_none_941860c977654550/presentationhost.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
amd64_wpf-presentationhostexe_31bf3856ad364e35_6.1.6001.18242_none_941860c977654550/presentationhost.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
amd64_wpf-presentationhostproxy_31bf3856ad364e35_6.1.6001.18242_none_4eaf4424d1168482/presentationhostproxy.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
amd64_wpf-presentationhostproxy_31bf3856ad364e35_6.1.6001.18242_none_4eaf4424d1168482/presentationhostproxy.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
x86_netfx-dfshim_dll_31bf3856ad364e35_6.1.6001.18242_none_40858864fbe3e0ce/dfshim.dll
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
x86_netfx-dfshim_dll_31bf3856ad364e35_6.1.6001.18242_none_40858864fbe3e0ce/dfshim.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
x86_netfx-fw_netfxperf_dll_31bf3856ad364e35_6.1.6001.18242_none_5c993a771a2304b1/netfxperf.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
x86_netfx-fw_netfxperf_dll_31bf3856ad364e35_6.1.6001.18242_none_5c993a771a2304b1/netfxperf.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
x86_netfx-mscoree_dll_31bf3856ad364e35_6.1.6001.18242_none_7d658e19f5139de5/mscoree.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
x86_netfx-mscoree_dll_31bf3856ad364e35_6.1.6001.18242_none_7d658e19f5139de5/mscoree.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
x86_netfx-mscorees_dll_31bf3856ad364e35_6.1.6001.18242_none_e15f1c362a176592/mscorees.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
x86_netfx-mscorees_dll_31bf3856ad364e35_6.1.6001.18242_none_e15f1c362a176592/mscorees.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
x86_wpf-presentationhostexe_31bf3856ad364e35_6.1.6001.18242_none_37f9c545bf07d41a/presentationhost.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
x86_wpf-presentationhostexe_31bf3856ad364e35_6.1.6001.18242_none_37f9c545bf07d41a/presentationhost.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
x86_wpf-presentationhostproxy_31bf3856ad364e35_6.1.6001.18242_none_f290a8a118b9134c/presentationhostproxy.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
x86_wpf-presentationhostproxy_31bf3856ad364e35_6.1.6001.18242_none_f290a8a118b9134c/presentationhostproxy.dll
Resource
win10v2004-20240802-en
General
-
Target
x86_wpf-presentationhostexe_31bf3856ad364e35_6.1.6001.18242_none_37f9c545bf07d41a/presentationhost.exe
-
Size
288KB
-
MD5
302964dcac79d618cc7b72c778da9fd2
-
SHA1
105b805b992f2b2fe4ddebb6915d616fc4f1e196
-
SHA256
7f2980aa49592b308e5d4c1a311ae837f65e9fb35761734a936626e81f0a7f10
-
SHA512
8bb5aac9f3839c143e67865f887e1a75eb41ede5ab6bb2964099f17b28b95e1a5e31fb0fb94b199b106692734205872f02a1cf9fa93ddce77e4964e7eba2408c
-
SSDEEP
6144:iWF3q7CxONtKUY1Ks3Vven5KNXAy3Odjp1w25KNXJwN:LvxONtKUY1Ks3VmKVAy3OdLNKVJwN
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language presentationhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\x86_wpf-presentationhostexe_31bf3856ad364e35_6.1.6001.18242_none_37f9c545bf07d41a\presentationhost.exe"C:\Users\Admin\AppData\Local\Temp\x86_wpf-presentationhostexe_31bf3856ad364e35_6.1.6001.18242_none_37f9c545bf07d41a\presentationhost.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4316