Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23/02/2025, 19:11
Behavioral task
behavioral1
Sample
2516-2-0x0000000010000000-0x000000001002D000-memory.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2516-2-0x0000000010000000-0x000000001002D000-memory.dll
Resource
win10v2004-20250217-en
General
-
Target
2516-2-0x0000000010000000-0x000000001002D000-memory.dll
-
Size
180KB
-
MD5
d5cffe9bdd8a128f41d9275d145f9bc1
-
SHA1
e00fbc1cd07e065e5b60d3462bf025bf9914ca9c
-
SHA256
b91252e20b2f5631f221ed6049bd3c1f788f41b426f731c50199f4aea2048af2
-
SHA512
ee3f045b025f06b09bae3ef52c1e453fb094553479c4ca3b012195957a7f18d20662a08ba86d1000f904f83dbcc34aa11bf0928771b96a93a3aea3d7da83412a
-
SSDEEP
3072:Pmu50sK9wH9ze5n5E8cj3WVvbHN3FBbALmp+tTBflJwhpnwpfrQ5:Pmu50s4wH9y5n5EFWVvbN3FBM1tTBvwv
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2548 1704 rundll32.exe 30 PID 1704 wrote to memory of 2548 1704 rundll32.exe 30 PID 1704 wrote to memory of 2548 1704 rundll32.exe 30 PID 1704 wrote to memory of 2548 1704 rundll32.exe 30 PID 1704 wrote to memory of 2548 1704 rundll32.exe 30 PID 1704 wrote to memory of 2548 1704 rundll32.exe 30 PID 1704 wrote to memory of 2548 1704 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2516-2-0x0000000010000000-0x000000001002D000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2516-2-0x0000000010000000-0x000000001002D000-memory.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2548
-