Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2022, 00:12
Static task
static1
Behavioral task
behavioral1
Sample
05a3a84096bcdc2a5cf87d07ede96aff7fd5037679f9585fee9a227c0d9cbf51.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
05a3a84096bcdc2a5cf87d07ede96aff7fd5037679f9585fee9a227c0d9cbf51.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
05a3a84096bcdc2a5cf87d07ede96aff7fd5037679f9585fee9a227c0d9cbf51.dll
-
Size
360KB
-
MD5
f4239e545b7e85527babcf8cb130df6f
-
SHA1
b7857b40b7e62fd5824c8d44cf3cf0afb993093d
-
SHA256
05a3a84096bcdc2a5cf87d07ede96aff7fd5037679f9585fee9a227c0d9cbf51
-
SHA512
1731c9b04935066a3e8535bb470c58348d5559fd52ac5dbe81b7c89d1bb3990ea41fa2a64e42cae2b797547721c3ddbace8ad78a3587c2a29567d2570c9d8cc1
-
SSDEEP
6144:tEzU6tlWhUspDKNU/BTri4vUPfEvtR4XPssmxVDhScT951nHhZAbohOn3:SzUAlW6shUUpi4cPfEvtWEBAo+
Malware Config
Signatures
-
Modifies registry class 2 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{0B1611ED-AD2E-4EA2-C61E-B18EC18DEEC7}\ = 5c28a3d08bb9de28825fb02f603d1bcda71373b4e362c257787d58b4fe5c5ec625c4d31a0df1772148959619c24f1b00935a30f2decc2acfd6215f0842d6c8203076928938d36fe1b02c76c9d2441bb6e9b1f01e178866c23dbf9cc727545a137312d7b846ab54c44167842985f1169efc668ff58a0718cb1218e5c789317310dd1b78aa0237749d03f96d3c5cd1fdfae0ea7ca78060d88d98e012e77234b56adc1aff6aa2c76c09b915fbe972325e434ed88a2d5c8f76b01921b5973ac8ef7fe7e8e6ede0247c9190862458c7602b47c6056f2ec298bb0a2fa608e5b7fe79a50e0e4c4fdc9cb88bfa4b99882948cc74b18dbd8eb21558d2e06da395ed05d88d5be07e25ceee7c8f regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{0B1611ED-AD2E-4EA2-C61E-B18EC18DEEC7} regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe 4968 regsvr32.exe