Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    17s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2024, 17:00

General

  • Target

    9f1c0d654088a06e2f3977ee66d33391325d5177afc4efe67f05ae042a08d889N.dll

  • Size

    120KB

  • MD5

    9196fa426ffa8405023ae3925a9aa6b0

  • SHA1

    8ee350a956272d3e04dd0e74dd9b21a9f9c213c0

  • SHA256

    9f1c0d654088a06e2f3977ee66d33391325d5177afc4efe67f05ae042a08d889

  • SHA512

    ca05ef4a8ff8b0169ce58398106516964830f47289d09d9554971f2a817ba988c42117678c36b41d860b9aed545bc95898708a88b912b1c1e57f1ebbfdb8eb5a

  • SSDEEP

    1536:ccdu6sMds58kkeGGDywYALln7OdBkYBfH90IuEw947YH8u1iwLWPfrQCmZMZA/yC:ceO8eNekE7e13LWPfrQCMMW/yxU

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9f1c0d654088a06e2f3977ee66d33391325d5177afc4efe67f05ae042a08d889N.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\9f1c0d654088a06e2f3977ee66d33391325d5177afc4efe67f05ae042a08d889N.dll
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1320

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads