Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
172s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2022, 22:36
Static task
static1
Behavioral task
behavioral1
Sample
ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d.dll
Resource
win10v2004-20220812-en
General
-
Target
ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d.dll
-
Size
292KB
-
MD5
97f5efa288eda2b70388f0900f2fdf35
-
SHA1
3d3ef1bc1ebbe172de61289c49a95c9dbaba940f
-
SHA256
ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d
-
SHA512
2ce182d21052729efb959cc9422943896315e334c73c381c052502c4f04afcf72b5f30bd952abaa5dbe993d270e989fa2ecd484404bc8e24b4f19d89090bf4b9
-
SSDEEP
6144:135zm5Oysu+wf3Qe1pgT6vH5UUNmBvvaH:13lm5Oy5/fgm6T6RUQiv
Malware Config
Signatures
-
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\ = "Zmapi" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4872 wrote to memory of 4748 4872 regsvr32.exe 82 PID 4872 wrote to memory of 4748 4872 regsvr32.exe 82 PID 4872 wrote to memory of 4748 4872 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d.dll2⤵
- Modifies registry class
PID:4748
-