Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

de05d6e905...18.exe

windows7-x64

8

de05d6e905...18.exe

windows10-2004-x64

8

ADVPACK.dll

windows7-x64

3

ADVPACK.dll

windows10-2004-x64

3

W95INF16.dll

windows7-x64

1

W95INF16.dll

windows10-2004-x64

1

W95INF32.dll

windows7-x64

3

W95INF32.dll

windows10-2004-x64

3

fngrprnt.dll

windows7-x64

3

fngrprnt.dll

windows10-2004-x64

3

msnphoto.scr

windows7-x64

3

msnphoto.scr

windows10-2004-x64

3

msvcr71.dll

windows7-x64

3

msvcr71.dll

windows10-2004-x64

3

pibase.dll

windows7-x64

3

pibase.dll

windows10-2004-x64

3

pidav.dll

windows7-x64

3

pidav.dll

windows10-2004-x64

3

piorg.dll

windows7-x64

3

piorg.dll

windows10-2004-x64

3

piorgres.dll

windows7-x64

1

piorgres.dll

windows10-2004-x64

1

pisync.dll

windows7-x64

3

pisync.dll

windows10-2004-x64

3

pisynctw.exe

windows7-x64

3

pisynctw.exe

windows10-2004-x64

3

piview.dll

windows7-x64

3

piview.dll

windows10-2004-x64

3

slides~1.js

windows7-x64

10

slides~1.js

windows10-2004-x64

10

startup.js

windows7-x64

3

startup.js

windows10-2004-x64

3

Analysis

  • max time kernel
    93s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/12/2024, 18:03 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ADVPACK.dll

  • Size

    90KB

  • MD5

    0ac28de5e930e8a52ad6b163c5473412

  • SHA1

    25371c9d876959cb58b50c25ad709cf98dde45bb

  • SHA256

    06eed244d89f6e15205d5beb8085ac33c0de486dfe30eec9fb73b91de07e5f62

  • SHA512

    c2c82449927cac953668142a3f597c06626b0b3a26e8036de34e4ca1042a572fa3befa799d43fb24a1d23c821b5ed7994e3d211b6aaced15ba31d4639e96d877

  • SSDEEP

    1536:Yoyomo1DLSaGi2aoIwPlL53Qtc1qpRBvgQbiSrvxekZCg0BUwTS9wpKSnZ0jJScy:z9J0I43QtcSRNgQnLx9ZCjGw8mZ0jJST

Score
3/10
discovery

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ADVPACK.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3964
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ADVPACK.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4712
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 628
        3⤵
        • Program crash
        PID:4656
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4712 -ip 4712
    1⤵
      PID:3984

    Network

    • flag-us
      DNS
      154.239.44.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      154.239.44.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      154.239.44.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      154.239.44.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      97.17.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      97.17.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      97.17.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      97.17.167.52.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      217.106.137.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.106.137.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      196.249.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      196.249.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      212.20.149.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      212.20.149.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      86.49.80.91.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      86.49.80.91.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      98.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      98.210.23.2.in-addr.arpa
      IN PTR
      Response
      98.210.23.2.in-addr.arpa
      IN PTR
      a2-23-210-98deploystaticakamaitechnologiescom
    • flag-us
      DNS
      13.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      101.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      101.210.23.2.in-addr.arpa
      IN PTR
      Response
      101.210.23.2.in-addr.arpa
      IN PTR
      a2-23-210-101deploystaticakamaitechnologiescom
    No results found
    • 8.8.8.8:53
      154.239.44.20.in-addr.arpa
      dns
      144 B
       158 B
       2
      1

      DNS Request

      154.239.44.20.in-addr.arpa

      DNS Request

      154.239.44.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      97.17.167.52.in-addr.arpa
      dns
      142 B
       145 B
       2
      1

      DNS Request

      97.17.167.52.in-addr.arpa

      DNS Request

      97.17.167.52.in-addr.arpa

    • 8.8.8.8:53
      217.106.137.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      217.106.137.52.in-addr.arpa

    • 8.8.8.8:53
      196.249.167.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      196.249.167.52.in-addr.arpa

    • 8.8.8.8:53
      212.20.149.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      212.20.149.52.in-addr.arpa

    • 8.8.8.8:53
      18.31.95.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      18.31.95.13.in-addr.arpa

    • 8.8.8.8:53
      86.49.80.91.in-addr.arpa
      dns
      70 B
       145 B
       1
      1

      DNS Request

      86.49.80.91.in-addr.arpa

    • 8.8.8.8:53
      98.210.23.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      98.210.23.2.in-addr.arpa

    • 8.8.8.8:53
      101.210.23.2.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      101.210.23.2.in-addr.arpa

    • 8.8.8.8:53
      13.227.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      13.227.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.