Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 17:00
Static task
static1
Behavioral task
behavioral1
Sample
9f1c0d654088a06e2f3977ee66d33391325d5177afc4efe67f05ae042a08d889N.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9f1c0d654088a06e2f3977ee66d33391325d5177afc4efe67f05ae042a08d889N.dll
Resource
win10v2004-20240802-en
General
-
Target
9f1c0d654088a06e2f3977ee66d33391325d5177afc4efe67f05ae042a08d889N.dll
-
Size
120KB
-
MD5
9196fa426ffa8405023ae3925a9aa6b0
-
SHA1
8ee350a956272d3e04dd0e74dd9b21a9f9c213c0
-
SHA256
9f1c0d654088a06e2f3977ee66d33391325d5177afc4efe67f05ae042a08d889
-
SHA512
ca05ef4a8ff8b0169ce58398106516964830f47289d09d9554971f2a817ba988c42117678c36b41d860b9aed545bc95898708a88b912b1c1e57f1ebbfdb8eb5a
-
SSDEEP
1536:ccdu6sMds58kkeGGDywYALln7OdBkYBfH90IuEw947YH8u1iwLWPfrQCmZMZA/yC:ceO8eNekE7e13LWPfrQCMMW/yxU
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2520 wrote to memory of 1320 2520 regsvr32.exe 30 PID 2520 wrote to memory of 1320 2520 regsvr32.exe 30 PID 2520 wrote to memory of 1320 2520 regsvr32.exe 30 PID 2520 wrote to memory of 1320 2520 regsvr32.exe 30 PID 2520 wrote to memory of 1320 2520 regsvr32.exe 30 PID 2520 wrote to memory of 1320 2520 regsvr32.exe 30 PID 2520 wrote to memory of 1320 2520 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\9f1c0d654088a06e2f3977ee66d33391325d5177afc4efe67f05ae042a08d889N.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\9f1c0d654088a06e2f3977ee66d33391325d5177afc4efe67f05ae042a08d889N.dll2⤵
- System Location Discovery: System Language Discovery
PID:1320
-