Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system -
submitted
07/02/2025, 18:34
Behavioral task
behavioral1
Sample
c299fc8ebfeee79107c1a63c7b1c31520b5501574a97896f2ecbb422f87be151.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
c299fc8ebfeee79107c1a63c7b1c31520b5501574a97896f2ecbb422f87be151.dll
Resource
win10v2004-20250207-en
General
-
Target
c299fc8ebfeee79107c1a63c7b1c31520b5501574a97896f2ecbb422f87be151.dll
-
Size
2.1MB
-
MD5
90718247549148ea2c1603f2dd67bec1
-
SHA1
d22b26898078357833bcff8aecd2b7fc6e24d689
-
SHA256
c299fc8ebfeee79107c1a63c7b1c31520b5501574a97896f2ecbb422f87be151
-
SHA512
6bca9f47e8b04966d78cad8e402eacb1031d7682c850a61b36bafac887f917b26ba20ee2ac65283b9d50a0e5a631cbc98627be909a36503902331fe2fca95797
-
SSDEEP
49152:bGgJ3vE7rwsY5+a+h1cHkUnl/u9Zx/PgxeAaE+bK2i4rG:NavI5+qHxsgxeAenrG
Malware Config
Signatures
-
Blocklisted process makes network request 15 IoCs
flow pid Process 6 4048 rundll32.exe 15 4048 rundll32.exe 19 4048 rundll32.exe 33 4048 rundll32.exe 36 4048 rundll32.exe 38 4048 rundll32.exe 40 4048 rundll32.exe 46 4048 rundll32.exe 49 4048 rundll32.exe 51 4048 rundll32.exe 56 4048 rundll32.exe 60 4048 rundll32.exe 63 4048 rundll32.exe 65 4048 rundll32.exe 67 4048 rundll32.exe -
Downloads MZ/PE file 1 IoCs
flow pid Process 30 64 Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2384 MicrosoftEdgeUpdate.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c299fc8ebfeee79107c1a63c7b1c31520b5501574a97896f2ecbb422f87be151.dll,#11⤵
- Blocklisted process makes network request
PID:4048
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzBBNTIxNEEtRjFGQy00MDk3LUFEM0ItOEEwQTJCMzRGQjNGfSIgdXNlcmlkPSJ7MUNFMDVBNjEtNTE5Qy00NTBELTg5NzEtRjMxNkQ0MUYyNUIzfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QzkxNTYxMjYtQzM3QS00MEYyLThENTMtMTI3QzkxRUY1OUI2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5ODUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODQ0NDQzNjAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTU4MTk2MzgzIi8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2384