Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 01:39
Static task
static1
Behavioral task
behavioral1
Sample
5a738bc13f111911358ff5d0dabf9660897162c9d3493c0924129bac038eb793.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5a738bc13f111911358ff5d0dabf9660897162c9d3493c0924129bac038eb793.dll
Resource
win10v2004-20241007-en
General
-
Target
5a738bc13f111911358ff5d0dabf9660897162c9d3493c0924129bac038eb793.dll
-
Size
4.7MB
-
MD5
bd745fd12f4298c0faf6d3cb1058bb30
-
SHA1
c0b140ff4199d43005b0bb464a48fd46e2e4f20e
-
SHA256
5a738bc13f111911358ff5d0dabf9660897162c9d3493c0924129bac038eb793
-
SHA512
718cdd8689b19d6646dd4802d468e898c4cb80784f5a70ab36dcbc054153b5da2a645e552f4734f95564f6c8252b342e79015314104d80778063f87c42670a4c
-
SSDEEP
12288:vsX/8q2Q74+6SFuNbeEaE38EYSYIVIdd/rZlPFvn07MjDn7jlE5:S/Jt6vaVH/rfFvn7
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1632 wrote to memory of 2472 1632 rundll32.exe 31 PID 1632 wrote to memory of 2472 1632 rundll32.exe 31 PID 1632 wrote to memory of 2472 1632 rundll32.exe 31 PID 1632 wrote to memory of 2472 1632 rundll32.exe 31 PID 1632 wrote to memory of 2472 1632 rundll32.exe 31 PID 1632 wrote to memory of 2472 1632 rundll32.exe 31 PID 1632 wrote to memory of 2472 1632 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5a738bc13f111911358ff5d0dabf9660897162c9d3493c0924129bac038eb793.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5a738bc13f111911358ff5d0dabf9660897162c9d3493c0924129bac038eb793.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2472
-