Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/03/2025, 17:17
Behavioral task
behavioral1
Sample
2188-14-0x0000000010000000-0x00000000104B5000-memory.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2188-14-0x0000000010000000-0x00000000104B5000-memory.dll
Resource
win10v2004-20250217-en
General
-
Target
2188-14-0x0000000010000000-0x00000000104B5000-memory.dll
-
Size
4.7MB
-
MD5
461977e700c8319f88f341aa323beb6f
-
SHA1
819196ebd4b3e1a3de967b352ba9b8d32712ae78
-
SHA256
fdbb0d4c78f4e4ee23b38de86186c59ed35ce08510a70d5f187a905f446df176
-
SHA512
67efd707947facbab92eb3ae20466c8afe571be4447d2b025641ed7f39b00219e0e9f8bc31445067f94a378ff9b41bd0c9d8535826fb5196ed8ada51db031e4d
-
SSDEEP
98304:HiDKwqik0QTmj01I4u1RBHmeqD4zCky9dgFwPD+8th5h:HiDKxiktTmj0iPRxmeqDkCky9N
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 768 wrote to memory of 1396 768 rundll32.exe 30 PID 768 wrote to memory of 1396 768 rundll32.exe 30 PID 768 wrote to memory of 1396 768 rundll32.exe 30 PID 768 wrote to memory of 1396 768 rundll32.exe 30 PID 768 wrote to memory of 1396 768 rundll32.exe 30 PID 768 wrote to memory of 1396 768 rundll32.exe 30 PID 768 wrote to memory of 1396 768 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2188-14-0x0000000010000000-0x00000000104B5000-memory.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1396
-