Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2024, 15:19
Behavioral task
behavioral1
Sample
491a068370c8688c7bdca9ce91ee0b7f84f91815fe4db8c18175b6b88e8e9474N.dll
Resource
win7-20240903-en
General
-
Target
491a068370c8688c7bdca9ce91ee0b7f84f91815fe4db8c18175b6b88e8e9474N.dll
-
Size
80KB
-
MD5
c657dc47dfddd87cd160ab21088f0840
-
SHA1
934bd5cdff74c93e2d022cabbf7c7340478b8149
-
SHA256
491a068370c8688c7bdca9ce91ee0b7f84f91815fe4db8c18175b6b88e8e9474
-
SHA512
a6931a3b6f4b25796b6d94312ab68f2e0c83696fa071de2f101df06a6b1cba0fb7b734e9bd413910b2e6242d6ee85e50e807227c1d67a19be698ed73babcb844
-
SSDEEP
1536:5POOhfbOjovgdVydUgoNrwBZXGDaZ1QIxrfItMgR7ZaO+fGxHZPEANHOjl:5dbwovEVyqgoZmZXWfIdQdRaefPDHOjl
Malware Config
Signatures
-
pid Process 3340 arp.exe 1844 arp.exe 2024 arp.exe 2588 arp.exe 1052 arp.exe 1668 arp.exe 3168 arp.exe 3480 arp.exe 2764 arp.exe -
resource yara_rule behavioral2/memory/3972-0-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/3972-1-0x0000000010000000-0x0000000010033000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2700 3972 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3972 rundll32.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2536 wrote to memory of 3972 2536 rundll32.exe 82 PID 2536 wrote to memory of 3972 2536 rundll32.exe 82 PID 2536 wrote to memory of 3972 2536 rundll32.exe 82 PID 3972 wrote to memory of 2764 3972 rundll32.exe 84 PID 3972 wrote to memory of 2764 3972 rundll32.exe 84 PID 3972 wrote to memory of 2764 3972 rundll32.exe 84 PID 3972 wrote to memory of 2588 3972 rundll32.exe 87 PID 3972 wrote to memory of 2588 3972 rundll32.exe 87 PID 3972 wrote to memory of 2588 3972 rundll32.exe 87 PID 3972 wrote to memory of 2024 3972 rundll32.exe 88 PID 3972 wrote to memory of 2024 3972 rundll32.exe 88 PID 3972 wrote to memory of 2024 3972 rundll32.exe 88 PID 3972 wrote to memory of 3340 3972 rundll32.exe 89 PID 3972 wrote to memory of 3340 3972 rundll32.exe 89 PID 3972 wrote to memory of 3340 3972 rundll32.exe 89 PID 3972 wrote to memory of 1844 3972 rundll32.exe 90 PID 3972 wrote to memory of 1844 3972 rundll32.exe 90 PID 3972 wrote to memory of 1844 3972 rundll32.exe 90 PID 3972 wrote to memory of 1052 3972 rundll32.exe 91 PID 3972 wrote to memory of 1052 3972 rundll32.exe 91 PID 3972 wrote to memory of 1052 3972 rundll32.exe 91 PID 3972 wrote to memory of 1668 3972 rundll32.exe 92 PID 3972 wrote to memory of 1668 3972 rundll32.exe 92 PID 3972 wrote to memory of 1668 3972 rundll32.exe 92 PID 3972 wrote to memory of 3168 3972 rundll32.exe 93 PID 3972 wrote to memory of 3168 3972 rundll32.exe 93 PID 3972 wrote to memory of 3168 3972 rundll32.exe 93 PID 3972 wrote to memory of 3480 3972 rundll32.exe 94 PID 3972 wrote to memory of 3480 3972 rundll32.exe 94 PID 3972 wrote to memory of 3480 3972 rundll32.exe 94
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\491a068370c8688c7bdca9ce91ee0b7f84f91815fe4db8c18175b6b88e8e9474N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\491a068370c8688c7bdca9ce91ee0b7f84f91815fe4db8c18175b6b88e8e9474N.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\SysWOW64\arp.exearp -a3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2764
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.0.1 05-4c-0c-f0-61-943⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2588
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.255.255 19-de-08-18-e0-e23⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2024
-
-
C:\Windows\SysWOW64\arp.exearp -s 136.243.69.123 5e-f4-a8-1a-f4-263⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3340
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.22 24-f1-ba-b5-eb-a53⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:1844
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.251 3c-81-2a-90-74-f63⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:1052
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.252 e1-18-a1-81-5e-3b3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:1668
-
-
C:\Windows\SysWOW64\arp.exearp -s 239.255.255.250 ff-0e-04-3d-e1-e83⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3168
-
-
C:\Windows\SysWOW64\arp.exearp -s 255.255.255.255 e8-30-17-9a-00-703⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 7083⤵
- Program crash
PID:2700
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3972 -ip 39721⤵PID:3032