Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
114s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 10:25
Static task
static1
Behavioral task
behavioral1
Sample
feba2d166650b40446ea4d686ae53deeb20f444324bb22347d672804367e3d3aN.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
feba2d166650b40446ea4d686ae53deeb20f444324bb22347d672804367e3d3aN.dll
Resource
win10v2004-20240802-en
General
-
Target
feba2d166650b40446ea4d686ae53deeb20f444324bb22347d672804367e3d3aN.dll
-
Size
5KB
-
MD5
d1d95080ddb5ed2d1a4ec82e6c619be0
-
SHA1
2b53834cb328cca4580be0f513f46d7b427aae95
-
SHA256
feba2d166650b40446ea4d686ae53deeb20f444324bb22347d672804367e3d3a
-
SHA512
26b0e6e5b3dd1fbcfa98907723f60feadf7875187adbdccc359e5b5185f983b73f9bbd76eca3825afb1770f59da5c9ba9d485b879897ae3c47c43c49f9b4c72f
-
SSDEEP
48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqPHLUrIo00z0i1n856IJkIkOARIiBt31Gud:hy859x0P8MaPQ0yolJFHAeiBt3VcmWU
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3508 wrote to memory of 3096 3508 rundll32.exe 89 PID 3508 wrote to memory of 3096 3508 rundll32.exe 89 PID 3508 wrote to memory of 3096 3508 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\feba2d166650b40446ea4d686ae53deeb20f444324bb22347d672804367e3d3aN.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\feba2d166650b40446ea4d686ae53deeb20f444324bb22347d672804367e3d3aN.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4616,i,15336851255456239337,16379811035920490645,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:81⤵PID:3260