Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 06:53
Static task
static1
Behavioral task
behavioral1
Sample
79e3894d4b35e50ce7642cbbd36237038c4d8d7963ad5e6c408d888354a80b69.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
79e3894d4b35e50ce7642cbbd36237038c4d8d7963ad5e6c408d888354a80b69.dll
Resource
win10v2004-20240910-en
General
-
Target
79e3894d4b35e50ce7642cbbd36237038c4d8d7963ad5e6c408d888354a80b69.dll
-
Size
179KB
-
MD5
01839ccd1c19116d2b078294164d32dc
-
SHA1
68dc7b37cec23b09e930175d41f6c902ae0e937a
-
SHA256
79e3894d4b35e50ce7642cbbd36237038c4d8d7963ad5e6c408d888354a80b69
-
SHA512
2ec16760eb5a3b34da1d6d9d781afc1349186e1187ab14213afc1fcb3b4cd3c9b9f24930434e48c3733193f53db856b73ccc500e53a3a5f181c3f6d00fe3dfdd
-
SSDEEP
3072:mtTCIxsOzCn0h7z4yTUp9OimOKWaRTYUIMOmVF2lQBV+UdE+rECWp7hKfzs:mtuIJToxmOKR09MOaBV+UdvrEFp7hKfw
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2488 3048 rundll32.exe 30 PID 3048 wrote to memory of 2488 3048 rundll32.exe 30 PID 3048 wrote to memory of 2488 3048 rundll32.exe 30 PID 3048 wrote to memory of 2488 3048 rundll32.exe 30 PID 3048 wrote to memory of 2488 3048 rundll32.exe 30 PID 3048 wrote to memory of 2488 3048 rundll32.exe 30 PID 3048 wrote to memory of 2488 3048 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\79e3894d4b35e50ce7642cbbd36237038c4d8d7963ad5e6c408d888354a80b69.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\79e3894d4b35e50ce7642cbbd36237038c4d8d7963ad5e6c408d888354a80b69.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2488
-