Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

17/01/2025, 13:15

250117-qhg8vsypcz 4

17/01/2025, 11:29

250117-nlw53swmar 4

09/01/2025, 21:28

250109-1bc1ns1qgt 4

05/01/2025, 19:25

250105-x44gjstlew 10

Analysis

  • max time kernel
    89s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/01/2025, 19:25

General

  • Target

    Bull140U.dll

  • Size

    3.2MB

  • MD5

    beeb151d977f3a5c505e6235fce14254

  • SHA1

    9547ccc48e35effef55891d9ac91aca118335cf0

  • SHA256

    ce673d3e52f338333790a0214a5032bc498af64a538158e7f4c540b40e0f6b04

  • SHA512

    1d12d39ff8d46021c8241a41ecc3875d8f017bb1d3b7abad8aa2c945b2b4c0472900ef5a7feabce657fb8a55f3586f9ad76d9e836c43cb3502b2bace32dbe985

  • SSDEEP

    49152:eucCrMzcHiNTP0aVY+cTiPA+uo8TWh6UU3JxpHIWkU1ZwnlmdE:ZPCtVYfbnoV6UCZHIxZ

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Bull140U.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3548
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\Bull140U.dll
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads