Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    10s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 11:04

General

  • Target

    07bddcbf1feae17125af160955d07134e71e50bbab08ce72e109fdb8480207ff.dll

  • Size

    269KB

  • MD5

    e5e64b12816715a26877618a965414e0

  • SHA1

    126ee168da21cc158d150ec2154515238e58fb08

  • SHA256

    07bddcbf1feae17125af160955d07134e71e50bbab08ce72e109fdb8480207ff

  • SHA512

    513204f80bc63e5fbc91bcb471079c94d0b186171adea734efcf90e69a10245108cf3d141d0ca31755b575e0bc0d23787ea6566a443b776772ff36f1d267cbbd

  • SSDEEP

    3072:ZypfQ0t2z0qOMiwhHEnkAxqACNQmVfzBl4g:ZyNd2Z5hqkBNQmVb

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies registry class 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\07bddcbf1feae17125af160955d07134e71e50bbab08ce72e109fdb8480207ff.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\07bddcbf1feae17125af160955d07134e71e50bbab08ce72e109fdb8480207ff.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:948

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/948-56-0x0000000075D01000-0x0000000075D03000-memory.dmp

    Filesize

    8KB

  • memory/1476-54-0x000007FEFC101000-0x000007FEFC103000-memory.dmp

    Filesize

    8KB