Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/01/2025, 15:32
Behavioral task
behavioral1
Sample
fa490b7cd87f24689ed1e21c1f866935274f923e6c7161bb7d2a70b67007582fN.dll
Resource
win7-20240903-en
General
-
Target
fa490b7cd87f24689ed1e21c1f866935274f923e6c7161bb7d2a70b67007582fN.dll
-
Size
203KB
-
MD5
8ff78a48cca2f69a88534fc5faa6c5f0
-
SHA1
e99f439ce3f45a39fd431e3feb594d336b74759f
-
SHA256
fa490b7cd87f24689ed1e21c1f866935274f923e6c7161bb7d2a70b67007582f
-
SHA512
5b220b300b5c0e210b30f0609a0aee7de556fe0ab434150d5d253563344ff95bf0bd829e6281ae2bb469d71d6adff13a5e1fd24cde5f6f662730f7f9c14051cb
-
SSDEEP
3072:aJ8IMILmCa3yx6oFEdgVXnF6C9Ugfxm32n7SpiMBxRUdn:5kmCaiEoFEd+F3txm2SpiMBxRUB
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
resource yara_rule behavioral1/memory/2972-0-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2972-2-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2972-3-0x0000000010000000-0x0000000010033000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2972 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2972 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2972 2172 rundll32.exe 30 PID 2172 wrote to memory of 2972 2172 rundll32.exe 30 PID 2172 wrote to memory of 2972 2172 rundll32.exe 30 PID 2172 wrote to memory of 2972 2172 rundll32.exe 30 PID 2172 wrote to memory of 2972 2172 rundll32.exe 30 PID 2172 wrote to memory of 2972 2172 rundll32.exe 30 PID 2172 wrote to memory of 2972 2172 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa490b7cd87f24689ed1e21c1f866935274f923e6c7161bb7d2a70b67007582fN.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa490b7cd87f24689ed1e21c1f866935274f923e6c7161bb7d2a70b67007582fN.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2972
-