Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
19s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 12:31
Behavioral task
behavioral1
Sample
c575b568b67047b74bb8741936cc86ffff2ea0ba58673f1b22ebf71d92dde283N.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c575b568b67047b74bb8741936cc86ffff2ea0ba58673f1b22ebf71d92dde283N.dll
Resource
win10v2004-20241007-en
General
-
Target
c575b568b67047b74bb8741936cc86ffff2ea0ba58673f1b22ebf71d92dde283N.dll
-
Size
203KB
-
MD5
eebe21f16054dd095ed034d039a64c10
-
SHA1
a9cd7216644a8ed02a3f852847d896147b8d5e42
-
SHA256
c575b568b67047b74bb8741936cc86ffff2ea0ba58673f1b22ebf71d92dde283
-
SHA512
b24d887dd4b35952571fa2d374b4c2df8d5a4d8664214eab4b681009ed6d7d80119ec967e8c344baf6fa227f253062a070f53f3263ca93e6c444bf2cc38bbd27
-
SSDEEP
3072:hJ8IMILmCa3yx6oFEdgVXnFYf7C9Ugfxm3Nep9viMnE6:0kmCaiEoFEd+FYOtxmdeviM1
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1788-2-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/1788-1-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/1788-3-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/1788-4-0x0000000010000000-0x0000000010033000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1788 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1788 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2408 wrote to memory of 1788 2408 rundll32.exe 28 PID 2408 wrote to memory of 1788 2408 rundll32.exe 28 PID 2408 wrote to memory of 1788 2408 rundll32.exe 28 PID 2408 wrote to memory of 1788 2408 rundll32.exe 28 PID 2408 wrote to memory of 1788 2408 rundll32.exe 28 PID 2408 wrote to memory of 1788 2408 rundll32.exe 28 PID 2408 wrote to memory of 1788 2408 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c575b568b67047b74bb8741936cc86ffff2ea0ba58673f1b22ebf71d92dde283N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c575b568b67047b74bb8741936cc86ffff2ea0ba58673f1b22ebf71d92dde283N.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1788
-