Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
12s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 21:57
Static task
static1
Behavioral task
behavioral1
Sample
56bfe5e00773e21fed756e96840e929ad8860fe1b281388e066956ec2b9de215.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
56bfe5e00773e21fed756e96840e929ad8860fe1b281388e066956ec2b9de215.dll
Resource
win10v2004-20241007-en
General
-
Target
56bfe5e00773e21fed756e96840e929ad8860fe1b281388e066956ec2b9de215.dll
-
Size
7KB
-
MD5
89c7af92adb69d1a3fcf11d90dd55bac
-
SHA1
18baa7d07f150278a3182f90c99906db07268142
-
SHA256
56bfe5e00773e21fed756e96840e929ad8860fe1b281388e066956ec2b9de215
-
SHA512
d2e83d9c9432a47425393da7e9580fa889368302a839b940a45119cdf6fd359a2c2381cb9dff0f1b9c65329fab8ab05e405cf250d96a561c9bb62c5e83538437
-
SSDEEP
96:DixZjmjtjd8jPjcZGR5TIJHNQ0EDm9H9G3EwDrR0rfEpL2FeW7gW:unSR6bgY8NrEDm9H9nw/qrfEx1WkW
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2224 3000 rundll32.exe 29 PID 3000 wrote to memory of 2224 3000 rundll32.exe 29 PID 3000 wrote to memory of 2224 3000 rundll32.exe 29 PID 3000 wrote to memory of 2224 3000 rundll32.exe 29 PID 3000 wrote to memory of 2224 3000 rundll32.exe 29 PID 3000 wrote to memory of 2224 3000 rundll32.exe 29 PID 3000 wrote to memory of 2224 3000 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\56bfe5e00773e21fed756e96840e929ad8860fe1b281388e066956ec2b9de215.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\56bfe5e00773e21fed756e96840e929ad8860fe1b281388e066956ec2b9de215.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2224
-