Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3BpmSyncVmd...IR.dll
windows11-21h2-x64
3BpmSyncVmd...15.dll
windows11-21h2-x64
3BpmSyncVmd...ry.exe
windows11-21h2-x64
3BpmSyncVmd...32.dll
windows11-21h2-x64
3BpmSyncVmd...it.dll
windows11-21h2-x64
3BpmSyncVmd...cp.dll
windows11-21h2-x64
3BpmSyncVmd...or.exe
windows11-21h2-x64
3Analysis
-
max time kernel
1479s -
max time network
1500s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
13/10/2024, 01:13
Static task
static1
Behavioral task
behavioral1
Sample
BpmSyncVmdGenerator/Adobe AIR/Versions/1.0/Adobe AIR.dll
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
BpmSyncVmdGenerator/Adobe AIR/Versions/1.0/Resources/AdobeCP15.dll
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
BpmSyncVmdGenerator/Adobe AIR/Versions/1.0/Resources/CaptiveAppEntry.exe
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
BpmSyncVmdGenerator/Adobe AIR/Versions/1.0/Resources/NPSWF32.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
BpmSyncVmdGenerator/Adobe AIR/Versions/1.0/Resources/WebKit.dll
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
BpmSyncVmdGenerator/Adobe AIR/Versions/1.0/Resources/adobecp.dll
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
BpmSyncVmdGenerator/BpmSyncVmdGenerator.exe
Resource
win11-20241007-en
General
-
Target
BpmSyncVmdGenerator/Adobe AIR/Versions/1.0/Resources/AdobeCP15.dll
-
Size
3.3MB
-
MD5
64a91e9ea17910657f8a7eaae7a4afd0
-
SHA1
c6e8637b6a5e11bd69b6d6a1742df4fc612fc08b
-
SHA256
6fcf417f525f29eb89243afdf82a97f9e85fb468e042b0f87cb6fc68d8933901
-
SHA512
0cfe0f26f345e9ae52c5fdb05a852d6b02aa6b1f0f1a17310e7d02885ace7cd52a26bbf9e4df8618242823282f499e3f162430abd218685649409b0c7f8b8805
-
SSDEEP
98304:XcYiLP9WspdG83NSXFx4irHUFEHbICfJZ37AYTXGsc:XcZLPjrG83NSXFx4irHUFEHbIQJZ8yW3
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4680 wrote to memory of 2012 4680 rundll32.exe 77 PID 4680 wrote to memory of 2012 4680 rundll32.exe 77 PID 4680 wrote to memory of 2012 4680 rundll32.exe 77
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\BpmSyncVmdGenerator\Adobe AIR\Versions\1.0\Resources\AdobeCP15.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\BpmSyncVmdGenerator\Adobe AIR\Versions\1.0\Resources\AdobeCP15.dll",#12⤵
- System Location Discovery: System Language Discovery
PID:2012
-