Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 09:30
Static task
static1
Behavioral task
behavioral1
Sample
797303e9c195170147d4c6b1d5519f90N.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
797303e9c195170147d4c6b1d5519f90N.dll
Resource
win10v2004-20240802-en
General
-
Target
797303e9c195170147d4c6b1d5519f90N.dll
-
Size
3KB
-
MD5
797303e9c195170147d4c6b1d5519f90
-
SHA1
ab15b71cab70d5e70404b1eb84064e410931591b
-
SHA256
32de7dec5a208e649de6100a2111168e9c26b0eadffaf60e7abb35cfba5e2b41
-
SHA512
6301ea71123ec61eb45feba70aa771ec092f7126397bcf496921c163e6a8f995c45abe5f42ecaa23eb2a23bac58bd5fe9fd3aa62997b90bfcc7107535cf0d566
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2308 2504 rundll32.exe 31 PID 2504 wrote to memory of 2308 2504 rundll32.exe 31 PID 2504 wrote to memory of 2308 2504 rundll32.exe 31 PID 2504 wrote to memory of 2308 2504 rundll32.exe 31 PID 2504 wrote to memory of 2308 2504 rundll32.exe 31 PID 2504 wrote to memory of 2308 2504 rundll32.exe 31 PID 2504 wrote to memory of 2308 2504 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\797303e9c195170147d4c6b1d5519f90N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\797303e9c195170147d4c6b1d5519f90N.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2308
-