Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
21s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28/10/2022, 17:44
Static task
static1
Behavioral task
behavioral1
Sample
606afd343503dd23c7eb73baee300d5a8346e79b6e11a316baf843478253ff1e.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
606afd343503dd23c7eb73baee300d5a8346e79b6e11a316baf843478253ff1e.dll
Resource
win10v2004-20220812-en
General
-
Target
606afd343503dd23c7eb73baee300d5a8346e79b6e11a316baf843478253ff1e.dll
-
Size
332KB
-
MD5
0af43acd70b0c953c590946c0da827af
-
SHA1
3e5e363e3789bedadabc8f73aeffd8cde9d396bf
-
SHA256
606afd343503dd23c7eb73baee300d5a8346e79b6e11a316baf843478253ff1e
-
SHA512
e775156826c07e8712b8cd812e7e57bcd0158b84c0c02f53cb425a224d33a9e4c0cd892369b7d34359af2389d6187e3ee0ea9f3314617074ac19149b66b8eeaa
-
SSDEEP
3072:EXAb6pLQdh+IXSSyDYl1yJksNqJp5AMoejrdVQPIL1Aml5Oy6L0ZaemDti9hBWWh:E+6pXIiSyssepKer2Zml4y6Ms4HoBhq
Malware Config
Signatures
-
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\main.BHO.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\main.BHO.1\CLSID\ = "{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\main.BHO\ = "Browser Helper Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\‚”#˜‚ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\main.BHO.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\main.BHO.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\main.BHO.1\ = "Browser Helper Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\main.BHO regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\main.BHO.1 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\main.BHO regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\‚”#˜‚ regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1032 wrote to memory of 1832 1032 regsvr32.exe 27 PID 1032 wrote to memory of 1832 1032 regsvr32.exe 27 PID 1032 wrote to memory of 1832 1032 regsvr32.exe 27 PID 1032 wrote to memory of 1832 1032 regsvr32.exe 27 PID 1032 wrote to memory of 1832 1032 regsvr32.exe 27 PID 1032 wrote to memory of 1832 1032 regsvr32.exe 27 PID 1032 wrote to memory of 1832 1032 regsvr32.exe 27
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\606afd343503dd23c7eb73baee300d5a8346e79b6e11a316baf843478253ff1e.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\606afd343503dd23c7eb73baee300d5a8346e79b6e11a316baf843478253ff1e.dll2⤵
- Modifies registry class
PID:1832
-