Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 10:45
Behavioral task
behavioral1
Sample
90c63a6eced0d7312e501cadcc0f4acacaa78aa134b7a8478409881a66a4dc3fN.dll
Resource
win7-20240708-en
General
-
Target
90c63a6eced0d7312e501cadcc0f4acacaa78aa134b7a8478409881a66a4dc3fN.dll
-
Size
187KB
-
MD5
f8beb027776a0af7c171899532ff14e0
-
SHA1
bf49b964301d11a4167beb454c5d80d669ac0d11
-
SHA256
90c63a6eced0d7312e501cadcc0f4acacaa78aa134b7a8478409881a66a4dc3f
-
SHA512
5f25778955d78e5f12827e7ec1630f96af113d6126522f12a72ab52873e456141f8df1fba99a6787219f16cea9ecac6a41d40822c22d305777a13e501a00dc5f
-
SSDEEP
3072:v8PNPo4DPRLCqdMZM4Uv1ikJd0JGUhrxXTsjp+xq7RJZlbka7kDZ1copUXdHLU5j:v8P+yPRLbOU4JNDcp+kRXljgDT1gSF0
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1928-3-0x0000000074FD0000-0x0000000075032000-memory.dmp vmprotect behavioral1/memory/1928-2-0x0000000074FD0000-0x0000000075032000-memory.dmp vmprotect behavioral1/memory/1928-0-0x0000000075050000-0x00000000750B2000-memory.dmp vmprotect -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1380 wrote to memory of 1928 1380 rundll32.exe 30 PID 1380 wrote to memory of 1928 1380 rundll32.exe 30 PID 1380 wrote to memory of 1928 1380 rundll32.exe 30 PID 1380 wrote to memory of 1928 1380 rundll32.exe 30 PID 1380 wrote to memory of 1928 1380 rundll32.exe 30 PID 1380 wrote to memory of 1928 1380 rundll32.exe 30 PID 1380 wrote to memory of 1928 1380 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\90c63a6eced0d7312e501cadcc0f4acacaa78aa134b7a8478409881a66a4dc3fN.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\90c63a6eced0d7312e501cadcc0f4acacaa78aa134b7a8478409881a66a4dc3fN.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1928
-