Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05/01/2025, 21:23
Static task
static1
Behavioral task
behavioral1
Sample
olii.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
olii.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/aneyji.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/aneyji.dll
Resource
win10v2004-20241007-en
General
-
Target
$PLUGINSDIR/aneyji.dll
-
Size
19KB
-
MD5
f7a30cb571aa862021ff786169f72a80
-
SHA1
d002635afeacd67ad2e5764d4dd07e0ec5f49ae3
-
SHA256
3c3b81e2f3de386bb78562b8005fcc582aa83d1bd5ac99aca14bd235f401c018
-
SHA512
7fc63a94a72b93ff57645d3e8c92726b7f77976ed5801461bfdaf4638dd8376565dad5f6663d1e0bd064e7521230b2b9f7aae90a5733f387fa003b22b501c69e
-
SSDEEP
384:mjrLtiTvRxxt1BoXiaQxmCc1abG8QMqjfB4z:krLYTvR7xJxmpKG8ay
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4260 3876 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2684 wrote to memory of 3876 2684 rundll32.exe 83 PID 2684 wrote to memory of 3876 2684 rundll32.exe 83 PID 2684 wrote to memory of 3876 2684 rundll32.exe 83 PID 3876 wrote to memory of 2408 3876 rundll32.exe 84 PID 3876 wrote to memory of 2408 3876 rundll32.exe 84 PID 3876 wrote to memory of 2408 3876 rundll32.exe 84 PID 3876 wrote to memory of 2408 3876 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aneyji.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aneyji.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aneyji.dll,#13⤵PID:2408
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 6683⤵
- Program crash
PID:4260
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3876 -ip 38761⤵PID:644