Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    47s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2022, 15:19

General

  • Target

    0a4af3200bad2613d57ffeb13c67d5f8384da0fc3875aba5c1d103a144069025.dll

  • Size

    116KB

  • MD5

    73992f394b7029791e74d59bb61bf098

  • SHA1

    93cf86f61ef6c488ee578b7b7efc97a91a3e59b4

  • SHA256

    0a4af3200bad2613d57ffeb13c67d5f8384da0fc3875aba5c1d103a144069025

  • SHA512

    cc5bd6af05ad87f1c9baf4129935387b61c34a586193e403bd7b8bdf51c47484810b69b49ed226c5877f5e98b307077f9726155fc6f80d4b9a0ad4195a342ee7

  • SSDEEP

    3072:CNL8INQ4fv7Tqo76IbghkCidj8DadlZ70UTh6Vq6hWpW3vTHl6mmohus:CNFWAtvTh+q6hWg3jlPPd

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry class 49 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0a4af3200bad2613d57ffeb13c67d5f8384da0fc3875aba5c1d103a144069025.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1380
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\0a4af3200bad2613d57ffeb13c67d5f8384da0fc3875aba5c1d103a144069025.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies Internet Explorer settings
      • Modifies registry class
      PID:824

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/824-56-0x00000000757A1000-0x00000000757A3000-memory.dmp

    Filesize

    8KB

  • memory/1380-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

    Filesize

    8KB