Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/01/2025, 21:23
Behavioral task
behavioral1
Sample
35da7547334065664e3a8233c1215a9b81aadb0e330ff9a9744870db69caaf69.dll
Resource
win7-20241010-en
General
-
Target
35da7547334065664e3a8233c1215a9b81aadb0e330ff9a9744870db69caaf69.dll
-
Size
76KB
-
MD5
c4a3e85a8a64fcf3c4e5b6b23549f224
-
SHA1
44a2052459a62c18a10fe6c4cdadbb628ce23865
-
SHA256
35da7547334065664e3a8233c1215a9b81aadb0e330ff9a9744870db69caaf69
-
SHA512
8446388b761f6198da8005e2cb0214cc98a81eba0b5a49a78ac0f9f73aaebf54deb795ef6d07f030947764509e689d598cdcaf7530a2950c63dd1c86f14664a2
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Z2uVd:c8y93KQjy7G55riF1cMo03z
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1812-1-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1812-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1812-2-0x0000000010000000-0x0000000010030000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1812 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1812 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1156 wrote to memory of 1812 1156 rundll32.exe 30 PID 1156 wrote to memory of 1812 1156 rundll32.exe 30 PID 1156 wrote to memory of 1812 1156 rundll32.exe 30 PID 1156 wrote to memory of 1812 1156 rundll32.exe 30 PID 1156 wrote to memory of 1812 1156 rundll32.exe 30 PID 1156 wrote to memory of 1812 1156 rundll32.exe 30 PID 1156 wrote to memory of 1812 1156 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\35da7547334065664e3a8233c1215a9b81aadb0e330ff9a9744870db69caaf69.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\35da7547334065664e3a8233c1215a9b81aadb0e330ff9a9744870db69caaf69.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1812
-