Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
103s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
03/11/2022, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
168f7e7c7d5f57b7574eb03f4013c3d56b99353c5c9e4695f3bab69f218191e7.dll
Resource
win10-20220812-en
5 signatures
150 seconds
General
-
Target
168f7e7c7d5f57b7574eb03f4013c3d56b99353c5c9e4695f3bab69f218191e7.dll
-
Size
814KB
-
MD5
4ca91127019d61899c09dbe33437b416
-
SHA1
ec0778d90b064619d6eb6fd3e7fc0d4b62b07db5
-
SHA256
168f7e7c7d5f57b7574eb03f4013c3d56b99353c5c9e4695f3bab69f218191e7
-
SHA512
962078ba8896701f0c6f2848065ec599d350b3ff242a033a7da9d9a1fef9d515f03d22a47aa948f26a982a96183957d5db7d081dc7a212b4582d86efb9611bc1
-
SSDEEP
12288:5sIyzbpudwh9PQx873eHeLs15pZ6yRQsf04Tn/WMideaik:5JyzbwdG4eLsjpZfRQ6/q8fk
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TAQnQUtrURQ.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\JLdXgUE\\TAQnQUtrURQ.dll\"" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2976 regsvr32.exe 2976 regsvr32.exe 2132 regsvr32.exe 2132 regsvr32.exe 2132 regsvr32.exe 2132 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2976 regsvr32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2132 2976 regsvr32.exe 66 PID 2976 wrote to memory of 2132 2976 regsvr32.exe 66
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\168f7e7c7d5f57b7574eb03f4013c3d56b99353c5c9e4695f3bab69f218191e7.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\JLdXgUE\TAQnQUtrURQ.dll"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2132
-