Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 02:28
Behavioral task
behavioral1
Sample
35bef39478577d735b1c8104f5800e95d73487284c89b281283e4c117688bd92.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
35bef39478577d735b1c8104f5800e95d73487284c89b281283e4c117688bd92.dll
Resource
win10v2004-20241007-en
General
-
Target
35bef39478577d735b1c8104f5800e95d73487284c89b281283e4c117688bd92.dll
-
Size
43KB
-
MD5
434b3d419af30403f6679f0578e9ed44
-
SHA1
089b875bca3e06156cdf0166896b2f1a9f64de58
-
SHA256
35bef39478577d735b1c8104f5800e95d73487284c89b281283e4c117688bd92
-
SHA512
5813f0b03db301595e533f65d0293b0488c5c27192b70f42f6f115e104eac63276571e1ceb7e2ae0214dc4f5aca2312fa03b8218c79de1045fc1661687b0f665
-
SSDEEP
768:LB8/jsvvTTnDDHB6N1XRMPWDY1cszRpC1EYQP8zMxNX1qy/MI4kJP2E4Ws4xKOpC:L6/jCDh6N1XYWDwzWxQkzMz1qUM3inaT
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2708 2212 regsvr32.exe 30 PID 2212 wrote to memory of 2708 2212 regsvr32.exe 30 PID 2212 wrote to memory of 2708 2212 regsvr32.exe 30 PID 2212 wrote to memory of 2708 2212 regsvr32.exe 30 PID 2212 wrote to memory of 2708 2212 regsvr32.exe 30 PID 2212 wrote to memory of 2708 2212 regsvr32.exe 30 PID 2212 wrote to memory of 2708 2212 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\35bef39478577d735b1c8104f5800e95d73487284c89b281283e4c117688bd92.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\35bef39478577d735b1c8104f5800e95d73487284c89b281283e4c117688bd92.dll2⤵
- System Location Discovery: System Language Discovery
PID:2708
-