Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
100s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
b8cabfe183e88fb7cc1320d87c7af7cac060e67529b8ec72558d469145d9798bN.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b8cabfe183e88fb7cc1320d87c7af7cac060e67529b8ec72558d469145d9798bN.dll
Resource
win10v2004-20241007-en
General
-
Target
b8cabfe183e88fb7cc1320d87c7af7cac060e67529b8ec72558d469145d9798bN.dll
-
Size
6KB
-
MD5
c1d9327e492ec42a89425659d3d50210
-
SHA1
8ddf518f44c6bfe933eee85b7ad713ec1d06ac12
-
SHA256
b8cabfe183e88fb7cc1320d87c7af7cac060e67529b8ec72558d469145d9798b
-
SHA512
7e1e5f22b1e7444bc7d19f2793499fd443d4a4a535777c8b01b84265387530e6b92a05e6d66ac72f2b1ca12163433616b100928605e6d65366ec4894de053443
-
SSDEEP
48:6AA35YVOQDV8FszwydlAYsLFV3G0PzB+BDq9J5S2:0QDV8FscMjsLFV33zB+FqX5S2
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2708 2792 rundll32.exe 30 PID 2792 wrote to memory of 2708 2792 rundll32.exe 30 PID 2792 wrote to memory of 2708 2792 rundll32.exe 30 PID 2792 wrote to memory of 2708 2792 rundll32.exe 30 PID 2792 wrote to memory of 2708 2792 rundll32.exe 30 PID 2792 wrote to memory of 2708 2792 rundll32.exe 30 PID 2792 wrote to memory of 2708 2792 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b8cabfe183e88fb7cc1320d87c7af7cac060e67529b8ec72558d469145d9798bN.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b8cabfe183e88fb7cc1320d87c7af7cac060e67529b8ec72558d469145d9798bN.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2708
-