Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3rebuilder.exe
windows10-1703-x64
3tool/core.jar
windows10-1703-x64
7tool/cyggcc_s-1.dll
windows10-1703-x64
3tool/cygwin1.dll
windows10-1703-x64
3tool/cygz.dll
windows10-1703-x64
3tool/dklic...or.exe
windows10-1703-x64
1tool/klic_...er.exe
windows10-1703-x64
1tool/rap2rifkey.exe
windows10-1703-x64
3tool/scetool.exe
windows10-1703-x64
3tool/sfk.exe
windows10-1703-x64
3Analysis
-
max time kernel
1791s -
max time network
1612s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
12/10/2024, 11:53
Static task
static1
Behavioral task
behavioral1
Sample
rebuilder.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
tool/core.jar
Resource
win10-20240611-en
Behavioral task
behavioral3
Sample
tool/cyggcc_s-1.dll
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
tool/cygwin1.dll
Resource
win10-20240611-en
Behavioral task
behavioral5
Sample
tool/cygz.dll
Resource
win10-20240611-en
Behavioral task
behavioral6
Sample
tool/dklic_validator.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
tool/klic_bruteforcer.exe
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
tool/rap2rifkey.exe
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
tool/scetool.exe
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
tool/sfk.exe
Resource
win10-20240404-en
General
-
Target
tool/cygwin1.dll
-
Size
2.7MB
-
MD5
6ca54d1af76525b0e35a369b0f08de43
-
SHA1
2124fabeb6adc54fe7d24f6055847a5d7a87b369
-
SHA256
df4e2115c80d07ca4345ba92053dcc38c4002554677a04509d02669a50ab86bf
-
SHA512
35c24f22e3d455aa13027946482eac85b778068770bfa8d9e3be85efe1a097eac65be89876a1ceb3ea352de50f7c914492a6b4c6ad1ad0c1e595d98a070ea0b6
-
SSDEEP
49152:w3x3HUVf3PULVdgzsSAeUP/A9mEEBSHMk9QPr010gDC/misu:wB3HUVf3cLngzsSFUXDSHMk9QPrM0gDK
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2908 rundll32.exe Token: SeBackupPrivilege 2908 rundll32.exe Token: SeDebugPrivilege 2908 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4584 wrote to memory of 2908 4584 rundll32.exe 70 PID 4584 wrote to memory of 2908 4584 rundll32.exe 70 PID 4584 wrote to memory of 2908 4584 rundll32.exe 70
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\tool\cygwin1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\tool\cygwin1.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2908
-