Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 14:15
Static task
static1
Behavioral task
behavioral1
Sample
5e3843a6cbc53a8278f840f1ed8995f3bd70b952634101564c3f84c7369c0b18N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5e3843a6cbc53a8278f840f1ed8995f3bd70b952634101564c3f84c7369c0b18N.dll
Resource
win10v2004-20240802-en
General
-
Target
5e3843a6cbc53a8278f840f1ed8995f3bd70b952634101564c3f84c7369c0b18N.dll
-
Size
5KB
-
MD5
3dd57612cd9af9b82ba07a4ba63f2b20
-
SHA1
64091e8bb854b0f608006ef86039e334b65f7885
-
SHA256
5e3843a6cbc53a8278f840f1ed8995f3bd70b952634101564c3f84c7369c0b18
-
SHA512
740ca8ac984487d1d91eeb5217640ce1b307336aac822238d8874f06604032b4a6f759e21c860b709dea8ffcfb5691e55ed485d5e3937585be6346b9caae8d5d
-
SSDEEP
96:hy859x0P8MaU3Y96K7+vAvGgyKhBasuh:F5oLljDSasu
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1644 wrote to memory of 2520 1644 rundll32.exe 30 PID 1644 wrote to memory of 2520 1644 rundll32.exe 30 PID 1644 wrote to memory of 2520 1644 rundll32.exe 30 PID 1644 wrote to memory of 2520 1644 rundll32.exe 30 PID 1644 wrote to memory of 2520 1644 rundll32.exe 30 PID 1644 wrote to memory of 2520 1644 rundll32.exe 30 PID 1644 wrote to memory of 2520 1644 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5e3843a6cbc53a8278f840f1ed8995f3bd70b952634101564c3f84c7369c0b18N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5e3843a6cbc53a8278f840f1ed8995f3bd70b952634101564c3f84c7369c0b18N.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2520
-