Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 06:53
Static task
static1
Behavioral task
behavioral1
Sample
79e3894d4b35e50ce7642cbbd36237038c4d8d7963ad5e6c408d888354a80b69.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
79e3894d4b35e50ce7642cbbd36237038c4d8d7963ad5e6c408d888354a80b69.dll
Resource
win10v2004-20240910-en
General
-
Target
79e3894d4b35e50ce7642cbbd36237038c4d8d7963ad5e6c408d888354a80b69.dll
-
Size
179KB
-
MD5
01839ccd1c19116d2b078294164d32dc
-
SHA1
68dc7b37cec23b09e930175d41f6c902ae0e937a
-
SHA256
79e3894d4b35e50ce7642cbbd36237038c4d8d7963ad5e6c408d888354a80b69
-
SHA512
2ec16760eb5a3b34da1d6d9d781afc1349186e1187ab14213afc1fcb3b4cd3c9b9f24930434e48c3733193f53db856b73ccc500e53a3a5f181c3f6d00fe3dfdd
-
SSDEEP
3072:mtTCIxsOzCn0h7z4yTUp9OimOKWaRTYUIMOmVF2lQBV+UdE+rECWp7hKfzs:mtuIJToxmOKR09MOaBV+UdvrEFp7hKfw
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2848 wrote to memory of 864 2848 rundll32.exe 85 PID 2848 wrote to memory of 864 2848 rundll32.exe 85 PID 2848 wrote to memory of 864 2848 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\79e3894d4b35e50ce7642cbbd36237038c4d8d7963ad5e6c408d888354a80b69.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\79e3894d4b35e50ce7642cbbd36237038c4d8d7963ad5e6c408d888354a80b69.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:864
-