Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/11/2022, 00:12
Static task
static1
Behavioral task
behavioral1
Sample
05a3a84096bcdc2a5cf87d07ede96aff7fd5037679f9585fee9a227c0d9cbf51.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
05a3a84096bcdc2a5cf87d07ede96aff7fd5037679f9585fee9a227c0d9cbf51.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
05a3a84096bcdc2a5cf87d07ede96aff7fd5037679f9585fee9a227c0d9cbf51.dll
-
Size
360KB
-
MD5
f4239e545b7e85527babcf8cb130df6f
-
SHA1
b7857b40b7e62fd5824c8d44cf3cf0afb993093d
-
SHA256
05a3a84096bcdc2a5cf87d07ede96aff7fd5037679f9585fee9a227c0d9cbf51
-
SHA512
1731c9b04935066a3e8535bb470c58348d5559fd52ac5dbe81b7c89d1bb3990ea41fa2a64e42cae2b797547721c3ddbace8ad78a3587c2a29567d2570c9d8cc1
-
SSDEEP
6144:tEzU6tlWhUspDKNU/BTri4vUPfEvtR4XPssmxVDhScT951nHhZAbohOn3:SzUAlW6shUUpi4cPfEvtWEBAo+
Malware Config
Signatures
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{C418BAD0-79AA-B657-75B4-023363DA80B8} regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{C418BAD0-79AA-B657-75B4-023363DA80B8}\ = 1e49301837df53173aeb4afa0b51c57c6e70817d00306b7ad70d4040d4a10b6fea6aaa5fecfe7721489516d9a25f13fcc5775f7c9fed5b561382efc02e3c9501818dd6eb2763078d6295b3241dd8dd93da89142c207440f1c51b2e38737e751df253b66f7e2f1a5b854537c1a903bfe3294f70537b188c71a92e5e73f36699cf8b02fb6c2187ccd9a18eb508d6921febefe6f2ea6d7d5d4cbbd02ac3e0e311585557224fd72c709b80ae0d72a608653555de09ed7c7fde0c5b0042cf1efa145bd517c29f3f804e9a1cfcf1f57826ca105e4149dd9abc89310bb49fa155ef60b08b4d2e3ecb10465c168546ee7c235042b886b713c7909b3ccf9105e432b112eea969bd077fd77b0d regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe 1660 regsvr32.exe