Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1058b64582e2...99.dll
windows7-x64
358b64582e2...99.dll
windows10-2004-x64
38bb29205d5...0b.dll
windows7-x64
38bb29205d5...0b.dll
windows10-2004-x64
3b262e47d42...bc.dll
windows7-x64
3b262e47d42...bc.dll
windows10-2004-x64
3c9390a1f7f...ca.dll
windows7-x64
3c9390a1f7f...ca.dll
windows10-2004-x64
3ec56a6bf59...12.dll
windows7-x64
3ec56a6bf59...12.dll
windows10-2004-x64
3ece3f43b8d...99.dll
windows7-x64
3ece3f43b8d...99.dll
windows10-2004-x64
3ef01bd51c0...e0.dll
windows7-x64
3ef01bd51c0...e0.dll
windows10-2004-x64
3f5da3e1d8e...20.dll
windows7-x64
3f5da3e1d8e...20.dll
windows10-2004-x64
3f77e988ff3...67.dll
windows7-x64
3f77e988ff3...67.dll
windows10-2004-x64
3fbaf9bcf1f...42.dll
windows7-x64
3fbaf9bcf1f...42.dll
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 23:42
Behavioral task
behavioral1
Sample
58b64582e298888676585cb3fe67f3c1f48b74e7ca56ba96b1b63d9baaa0fa99.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
58b64582e298888676585cb3fe67f3c1f48b74e7ca56ba96b1b63d9baaa0fa99.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
8bb29205d5fd1c8dcff683dbcca2c70697f2fcafc799e4060b987868f4838c0b.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
8bb29205d5fd1c8dcff683dbcca2c70697f2fcafc799e4060b987868f4838c0b.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
b262e47d429a9705e173ca20401db353e887c1adec9d16c649503b31b7b2dcbc.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
b262e47d429a9705e173ca20401db353e887c1adec9d16c649503b31b7b2dcbc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
c9390a1f7fcb2250a77b952b66272ec2272a0e371725ab0d50a435e012d299ca.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
c9390a1f7fcb2250a77b952b66272ec2272a0e371725ab0d50a435e012d299ca.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
ec56a6bf598c179d048d457ccb42f6b39cc4d37d7252b403a0947c942b53fc12.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
ec56a6bf598c179d048d457ccb42f6b39cc4d37d7252b403a0947c942b53fc12.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
ece3f43b8dbc408716c3b9acbdc3a02a4b8f11eab204e3c5f1f5bdcfa5bfe599.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
ece3f43b8dbc408716c3b9acbdc3a02a4b8f11eab204e3c5f1f5bdcfa5bfe599.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
ef01bd51c036d68316dfe8e98adc30fffecd521bd36cfac6dc86b06c0f9188e0.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
ef01bd51c036d68316dfe8e98adc30fffecd521bd36cfac6dc86b06c0f9188e0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
f5da3e1d8ea95ea2d969c460396447a9bdab242c2df1dcbc2e88a98452393620.dll
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
f5da3e1d8ea95ea2d969c460396447a9bdab242c2df1dcbc2e88a98452393620.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
f77e988ff3f0ff5af39bb4d769606ec49acd0e32551be27bfdca84782ab5f667.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
f77e988ff3f0ff5af39bb4d769606ec49acd0e32551be27bfdca84782ab5f667.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
fbaf9bcf1f9fdbbccbcdf2060e791fc8392c8fdbee1381002e0bd45c1744e042.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
fbaf9bcf1f9fdbbccbcdf2060e791fc8392c8fdbee1381002e0bd45c1744e042.dll
Resource
win10v2004-20241007-en
General
-
Target
c9390a1f7fcb2250a77b952b66272ec2272a0e371725ab0d50a435e012d299ca.dll
-
Size
565KB
-
MD5
a0fb9121db6f7332d816f9531705f80d
-
SHA1
8d42c66baded0db053eb30c4ff496db5581ca70d
-
SHA256
c9390a1f7fcb2250a77b952b66272ec2272a0e371725ab0d50a435e012d299ca
-
SHA512
722f59785e8933c4b9207c86f148762ac123f13d2a51c40fc3dbebb05eb31635f0931d7fe63d16537ce5e2ecb5b04fbdffe7918ee07dd93694bf6f2264867c05
-
SSDEEP
6144:QY9BwRtnWZSfNvgm8X5cnzokIUCQHmYerv/fhh7BYnbXLk5xdAQDlIsJJLkZdP7:csSFv8pczokIUCkmr/7unbQxrpI2e7
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2488 wrote to memory of 3028 2488 rundll32.exe 30 PID 2488 wrote to memory of 3028 2488 rundll32.exe 30 PID 2488 wrote to memory of 3028 2488 rundll32.exe 30 PID 2488 wrote to memory of 3028 2488 rundll32.exe 30 PID 2488 wrote to memory of 3028 2488 rundll32.exe 30 PID 2488 wrote to memory of 3028 2488 rundll32.exe 30 PID 2488 wrote to memory of 3028 2488 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c9390a1f7fcb2250a77b952b66272ec2272a0e371725ab0d50a435e012d299ca.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c9390a1f7fcb2250a77b952b66272ec2272a0e371725ab0d50a435e012d299ca.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3028
-