Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/01/2025, 23:31
Static task
static1
Behavioral task
behavioral1
Sample
1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/snorts.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/snorts.dll
Resource
win10v2004-20241007-en
General
-
Target
$PLUGINSDIR/snorts.dll
-
Size
22KB
-
MD5
03335eedd55f4e846c30f6e343b79f72
-
SHA1
d97be693fa21f3e1f75f6aec08c943a5589d0de4
-
SHA256
0379140a954b9a8cd1be8fa6302a7296af60298b7af77a1e40914f95d012b647
-
SHA512
2f43d9a46c720ae424354b5082f37422d8add2d0931f628fb8f503de5860c94efd130bf66b61efaf6865984fea573d122ada603af06aec56286cd29d9faf5b18
-
SSDEEP
384:Hj4re84+kszLu+16L2DXrnLV4lOPqAWwE1poFirP7X:LP3s+SSfOPqANepo6
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 780 1720 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2244 wrote to memory of 1720 2244 rundll32.exe 31 PID 2244 wrote to memory of 1720 2244 rundll32.exe 31 PID 2244 wrote to memory of 1720 2244 rundll32.exe 31 PID 2244 wrote to memory of 1720 2244 rundll32.exe 31 PID 2244 wrote to memory of 1720 2244 rundll32.exe 31 PID 2244 wrote to memory of 1720 2244 rundll32.exe 31 PID 2244 wrote to memory of 1720 2244 rundll32.exe 31 PID 1720 wrote to memory of 780 1720 rundll32.exe 32 PID 1720 wrote to memory of 780 1720 rundll32.exe 32 PID 1720 wrote to memory of 780 1720 rundll32.exe 32 PID 1720 wrote to memory of 780 1720 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\snorts.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\snorts.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 2243⤵
- Program crash
PID:780
-
-