Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3rebuilder.exe
windows10-1703-x64
3tool/core.jar
windows10-1703-x64
7tool/cyggcc_s-1.dll
windows10-1703-x64
3tool/cygwin1.dll
windows10-1703-x64
3tool/cygz.dll
windows10-1703-x64
3tool/dklic...or.exe
windows10-1703-x64
1tool/klic_...er.exe
windows10-1703-x64
1tool/rap2rifkey.exe
windows10-1703-x64
3tool/scetool.exe
windows10-1703-x64
3tool/sfk.exe
windows10-1703-x64
3Analysis
-
max time kernel
314s -
max time network
1595s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
12/10/2024, 11:53
Static task
static1
Behavioral task
behavioral1
Sample
rebuilder.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
tool/core.jar
Resource
win10-20240611-en
Behavioral task
behavioral3
Sample
tool/cyggcc_s-1.dll
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
tool/cygwin1.dll
Resource
win10-20240611-en
Behavioral task
behavioral5
Sample
tool/cygz.dll
Resource
win10-20240611-en
Behavioral task
behavioral6
Sample
tool/dklic_validator.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
tool/klic_bruteforcer.exe
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
tool/rap2rifkey.exe
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
tool/scetool.exe
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
tool/sfk.exe
Resource
win10-20240404-en
General
-
Target
tool/cygz.dll
-
Size
71KB
-
MD5
1bfb7d20779f3506a91086f2dcfe9203
-
SHA1
3108efe9a90bde5d7f60c01d3e66f35eaf3752b1
-
SHA256
c8c3a59c37edba3f80f8f4e837968a0c3eedd153fb8d79b2123a2bbea8e32c53
-
SHA512
a053171b3755b9c8f05be7eafe145e9f4d8dee77d2f11ef379349d8a1f02adaafa06391f6ad017013d1a51738eafa25401455ddca55f20c6eacc9f1859a0d831
-
SSDEEP
1536:xPba121uUtTXYsrsfNAk09bUAKsVvdqRurmjnToIfpIOOIOYQ/bOY:ZC21uMYx09b7KhTBfD8YQ/bOY
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 4068 rundll32.exe Token: SeBackupPrivilege 4068 rundll32.exe Token: SeDebugPrivilege 4068 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 900 wrote to memory of 4068 900 rundll32.exe 70 PID 900 wrote to memory of 4068 900 rundll32.exe 70 PID 900 wrote to memory of 4068 900 rundll32.exe 70
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\tool\cygz.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\tool\cygz.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4068
-