Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    39s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2022, 00:25 UTC

General

  • Target

    f85544dc54d06caa843a8f4c7ab3047828f0023be63b6ec4b9ef402f04682be8.dll

  • Size

    107KB

  • MD5

    4e511b54283ab37484c2d7ca46bcff50

  • SHA1

    a087e6b98a90b2b94f4234a668e0dbf74d01f1bd

  • SHA256

    f85544dc54d06caa843a8f4c7ab3047828f0023be63b6ec4b9ef402f04682be8

  • SHA512

    dc293a6960f52b68d39ea50ef6a35c30d64a45758febada20dff92095136c9931e22ccfbbf2442b649acbb5170624f0e1c1735e21f3d6d9232617c0ac8452616

  • SSDEEP

    3072:Yur+QqjIC5KdKqoDayYmAr8iaETpCzpzJtEIw1P:FKt+p8DYmW8iaET8z+Iw1

Score
8/10

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
  • Modifies registry class 41 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f85544dc54d06caa843a8f4c7ab3047828f0023be63b6ec4b9ef402f04682be8.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\f85544dc54d06caa843a8f4c7ab3047828f0023be63b6ec4b9ef402f04682be8.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies Internet Explorer settings
      • Modifies registry class
      PID:2032

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1088-54-0x000007FEFC431000-0x000007FEFC433000-memory.dmp

    Filesize

    8KB

  • memory/2032-56-0x0000000076681000-0x0000000076683000-memory.dmp

    Filesize

    8KB

  • memory/2032-57-0x0000000010000000-0x0000000010041000-memory.dmp

    Filesize

    260KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.