Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1Readm.md/cef.js
windows7-x64
3Readm.md/cef.js
windows10-2004-x64
3Readm.md/c...ent.js
windows7-x64
3Readm.md/c...ent.js
windows10-2004-x64
3Readm.md/c...ent.js
windows7-x64
3Readm.md/c...ent.js
windows10-2004-x64
3Readm.md/c...lf.dll
windows7-x64
3Readm.md/c...lf.dll
windows10-2004-x64
3Readm.md/w...11.dll
windows7-x64
3Readm.md/w...11.dll
windows10-2004-x64
3lnstaIIer .x64.exe
windows7-x64
1lnstaIIer .x64.exe
windows10-2004-x64
10Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/12/2024, 02:14
Static task
static1
Behavioral task
behavioral1
Sample
Readm.md/cef.js
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Readm.md/cef.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Readm.md/cef_100_percent.js
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Readm.md/cef_100_percent.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Readm.md/cef_200_percent.js
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Readm.md/cef_200_percent.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Readm.md/chrome_elf.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Readm.md/chrome_elf.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Readm.md/wow64/YandexDisk3ShellExt-1511.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Readm.md/wow64/YandexDisk3ShellExt-1511.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
lnstaIIer .x64.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
lnstaIIer .x64.exe
Resource
win10v2004-20241007-en
General
-
Target
Readm.md/chrome_elf.dll
-
Size
433KB
-
MD5
d0a014abef7e4b74e9f1ad2933a1bf12
-
SHA1
5f895f244e88912f3d1d0602ee154b538701c0de
-
SHA256
9a5a2fa253aedf6a131cbd1d6c2e77c33ee116a245afa8319421de0dfe518303
-
SHA512
575fda7b8da29a40ca636eec9a3d08ce70a5cd59d5211476f3c126a8c81ae736df59c965dcca859bcff90b83240276daae4674194ff7437d7b984a670202ff8c
-
SSDEEP
6144:mJMF2l7Xo4E9DSuCq8+UW543vs+5URaAUlS196jBimneQgwBxrFAOHV7GFTK0uQ5:mod9Db5Ys+5QaAUlS196jQ47VFFEFnX5
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1032 wrote to memory of 2684 1032 rundll32.exe 30 PID 1032 wrote to memory of 2684 1032 rundll32.exe 30 PID 1032 wrote to memory of 2684 1032 rundll32.exe 30 PID 1032 wrote to memory of 2684 1032 rundll32.exe 30 PID 1032 wrote to memory of 2684 1032 rundll32.exe 30 PID 1032 wrote to memory of 2684 1032 rundll32.exe 30 PID 1032 wrote to memory of 2684 1032 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Readm.md\chrome_elf.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Readm.md\chrome_elf.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2684
-