Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
180s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 03:27
Behavioral task
behavioral1
Sample
740235d1d5fa07be507d714d4a2041e1f442cb3c26f87cb492f3d5ff88a72e8a.dll
Resource
win7-20221111-en
4 signatures
150 seconds
General
-
Target
740235d1d5fa07be507d714d4a2041e1f442cb3c26f87cb492f3d5ff88a72e8a.dll
-
Size
702KB
-
MD5
671e15c112bd2012c54bbf6c5a55d90d
-
SHA1
a95c02e7c87bd4765a2adb67e8970cd13d0f17c6
-
SHA256
740235d1d5fa07be507d714d4a2041e1f442cb3c26f87cb492f3d5ff88a72e8a
-
SHA512
c9d17df88adabece7b0a16f03b935049e661f86c6761dbfa5dfc920b9640d9e57816a9b0d855502833b7584beabbb6f835f69bc1451e5188ba1c99239be6ee24
-
SSDEEP
12288:FZQCH8vm3j+KL94/4N7Yr0AxaAMwzWWGPNeBCwwN/KtaP7F7W7RqWeP2OZWejijd:svIjRAq8RMwzWWmwwN/KtazF7GR9ePbA
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3432-133-0x0000000000400000-0x0000000000739000-memory.dmp upx behavioral2/memory/3432-134-0x0000000000400000-0x0000000000739000-memory.dmp upx behavioral2/memory/3432-135-0x0000000000400000-0x0000000000739000-memory.dmp upx behavioral2/memory/3432-138-0x0000000000400000-0x0000000000739000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{09AFB2CE-9837-CA3E-0CB1-0A0B00C83DF2} regsvr32.exe -
Modifies registry class 11 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09AFB2CE-9837-CA3E-0CB1-0A0B00C83DF2}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\740235d1d5fa07be507d714d4a2041e1f442cb3c26f87cb492f3d5ff88a72e8a.MS_Plugin_115 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\740235d1d5fa07be507d714d4a2041e1f442cb3c26f87cb492f3d5ff88a72e8a.MS_Plugin_115\ = "MS_Plugin" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\740235d1d5fa07be507d714d4a2041e1f442cb3c26f87cb492f3d5ff88a72e8a.MS_Plugin_115\Clsid\ = "{09AFB2CE-9837-CA3E-0CB1-0A0B00C83DF2}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09AFB2CE-9837-CA3E-0CB1-0A0B00C83DF2}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09AFB2CE-9837-CA3E-0CB1-0A0B00C83DF2}\ProgID\ = "740235d1d5fa07be507d714d4a2041e1f442cb3c26f87cb492f3d5ff88a72e8a.MS_Plugin_115" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09AFB2CE-9837-CA3E-0CB1-0A0B00C83DF2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09AFB2CE-9837-CA3E-0CB1-0A0B00C83DF2}\ = "MS_Plugin" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09AFB2CE-9837-CA3E-0CB1-0A0B00C83DF2}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09AFB2CE-9837-CA3E-0CB1-0A0B00C83DF2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\740235d1d5fa07be507d714d4a2041e1f442cb3c26f87cb492f3d5ff88a72e8a.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\740235d1d5fa07be507d714d4a2041e1f442cb3c26f87cb492f3d5ff88a72e8a.MS_Plugin_115\Clsid regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1080 wrote to memory of 3432 1080 regsvr32.exe 83 PID 1080 wrote to memory of 3432 1080 regsvr32.exe 83 PID 1080 wrote to memory of 3432 1080 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\740235d1d5fa07be507d714d4a2041e1f442cb3c26f87cb492f3d5ff88a72e8a.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\740235d1d5fa07be507d714d4a2041e1f442cb3c26f87cb492f3d5ff88a72e8a.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:3432
-