Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1462s -
max time network
1481s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
25/10/2024, 21:00
Behavioral task
behavioral1
Sample
YT_Channel_Downloader_installer.exe
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/System.dll
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
YT_Channel_Downloader.exe
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
main.pyc
Resource
win11-20241007-en
General
-
Target
$PLUGINSDIR/nsDialogs.dll
-
Size
9KB
-
MD5
b7d61f3f56abf7b7ff0d4e7da3ad783d
-
SHA1
15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
-
SHA256
89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
-
SHA512
6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
-
SSDEEP
96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2912 4928 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2320 wrote to memory of 4928 2320 rundll32.exe 81 PID 2320 wrote to memory of 4928 2320 rundll32.exe 81 PID 2320 wrote to memory of 4928 2320 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4928 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 5443⤵
- Program crash
PID:2912
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 4928 -ip 49281⤵PID:4936