Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29/09/2024, 04:54

General

  • Target

    $SYSDIR/$SYSDIR/$_2_.dll

  • Size

    215KB

  • MD5

    a628c2436fb065a33bc0a1ee4b693f3d

  • SHA1

    3106b4fbda40ec5924265a501125e7f575116346

  • SHA256

    de664dee0a4aa1e55247d8bab061a760657a712bae96f94a8ff21190661e1d5a

  • SHA512

    2b751efe7726fd6d4d4871df79d640639e85eee6a23685b9d9ac06dccb6dbcabb4f4ad0cc0811a51bc7de10832ef3d132ed4cfffa5980a0a1f6250353172de83

  • SSDEEP

    3072:tDFxpWmt9oPEgYQTeD6xrmwuVv2+/EY4jh8FIiOM/64aEoPr7tWt3dtl4Z:tZEYQJMVtT9Su/6bTZWt3dtl4Z

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$SYSDIR\$_2_.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2600
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\$SYSDIR\$_2_.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2004

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads