Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2025, 05:05
Behavioral task
behavioral1
Sample
c8842269725e46ce9cc9b80a83a5eec745c6ce3d556c1fbede944f8f4548c9cc.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c8842269725e46ce9cc9b80a83a5eec745c6ce3d556c1fbede944f8f4548c9cc.dll
Resource
win10v2004-20250129-en
General
-
Target
c8842269725e46ce9cc9b80a83a5eec745c6ce3d556c1fbede944f8f4548c9cc.dll
-
Size
76KB
-
MD5
542b05556a1638a3464c819ae680550a
-
SHA1
a1135580e269cfffbbc029ea325e474a5c222ef8
-
SHA256
c8842269725e46ce9cc9b80a83a5eec745c6ce3d556c1fbede944f8f4548c9cc
-
SHA512
1642a66c0e8c8b9b9dbac9dfd5a665ba4df0dd5320da1338bd7b71f879bcaf3404a06c0474493881105ad8cc98376f01c9d0c25c472a6bcedd8b81a8788789ba
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZkqvERNB:c8y93KQjy7G55riF1cMo03VMRNB
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
resource yara_rule behavioral2/memory/3332-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/3332-1-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 1572 3332 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3332 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3424 wrote to memory of 3332 3424 rundll32.exe 83 PID 3424 wrote to memory of 3332 3424 rundll32.exe 83 PID 3424 wrote to memory of 3332 3424 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c8842269725e46ce9cc9b80a83a5eec745c6ce3d556c1fbede944f8f4548c9cc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c8842269725e46ce9cc9b80a83a5eec745c6ce3d556c1fbede944f8f4548c9cc.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3332 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 7123⤵
- Program crash
PID:1572
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3332 -ip 33321⤵PID:4392