Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/12/2024, 14:37
Behavioral task
behavioral1
Sample
028f20b8b370aafb5a55052a2e8619e067f414bccb26cc6c562a22067adb2026N.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
028f20b8b370aafb5a55052a2e8619e067f414bccb26cc6c562a22067adb2026N.dll
Resource
win10v2004-20241007-en
General
-
Target
028f20b8b370aafb5a55052a2e8619e067f414bccb26cc6c562a22067adb2026N.dll
-
Size
76KB
-
MD5
69f04c43da58dc923a5e36c14d267490
-
SHA1
bf06cd8320a16a88916652cb38e7056c1a13a5fa
-
SHA256
028f20b8b370aafb5a55052a2e8619e067f414bccb26cc6c562a22067adb2026
-
SHA512
db7ccf7a90a82a887651d14a1a9db7a2119774a8825fed815a6a1e9a593c9b041b489cb1ad9bc6bb82d3e4667abb296e0d0e62fb83f8452bd2e1c5988ceb3362
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Z5sfQa5P7:c8y93KQjy7G55riF1cMo03387
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
resource yara_rule behavioral2/memory/1648-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/1648-1-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 1572 1648 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1648 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4768 wrote to memory of 1648 4768 rundll32.exe 82 PID 4768 wrote to memory of 1648 4768 rundll32.exe 82 PID 4768 wrote to memory of 1648 4768 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\028f20b8b370aafb5a55052a2e8619e067f414bccb26cc6c562a22067adb2026N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\028f20b8b370aafb5a55052a2e8619e067f414bccb26cc6c562a22067adb2026N.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1648 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 7043⤵
- Program crash
PID:1572
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1648 -ip 16481⤵PID:3164