Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
193s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 00:18
Static task
static1
Behavioral task
behavioral1
Sample
32d304dfd2a7b6fc2dbcceca1499e008c447747ef8e83e4f11adce0fcf24d105.dll
Resource
win7-20220812-en
3 signatures
150 seconds
General
-
Target
32d304dfd2a7b6fc2dbcceca1499e008c447747ef8e83e4f11adce0fcf24d105.dll
-
Size
65KB
-
MD5
3ae6fe26349a398375ad76f2198647e0
-
SHA1
379f35926b625e1505e8d0a7cda85adad9be2be1
-
SHA256
32d304dfd2a7b6fc2dbcceca1499e008c447747ef8e83e4f11adce0fcf24d105
-
SHA512
9e250ba19730e4eef2a0c68f30b86e2be5f3657cee60d18789837bcfef7a608a52adc8d508b07fc60cff11c5647c1430d143d653405f19bb2d7b5e156c6b113e
-
SSDEEP
1536:xai9YMgs1niQTaX11TNj4M03bNTNjdBKb+EyhV+hIK:si9JniQE1RB0LFVKPyDSIK
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DF5EF25D-1110-1029-B63D-43D18AA79934} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DF5EF25D-1110-1029-B63D-43D18AA79934}\ = "windowsmedia v2" regsvr32.exe -
Modifies registry class 51 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6173378F-611E-401B-AAB3-A197DF144470}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6D5CDD2-63FF-1DD7-9991-E2C578609F0F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6D5CDD2-63FF-1DD7-9991-E2C578609F0F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\v2.1\CLSID\ = "{DF5EF25D-1110-1029-B63D-43D18AA79934}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\v2\ = "windowsmedia v2 Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF5EF25D-1110-1029-B63D-43D18AA79934}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6173378F-611E-401B-AAB3-A197DF144470}\1.0\ = "windowsmedia v2 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6D5CDD2-63FF-1DD7-9991-E2C578609F0F}\ = "IIECatch" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6D5CDD2-63FF-1DD7-9991-E2C578609F0F}\ = "IIECatch" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6D5CDD2-63FF-1DD7-9991-E2C578609F0F}\TypeLib\ = "{6173378F-611E-401B-AAB3-A197DF144470}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\windowsmedia regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF5EF25D-1110-1029-B63D-43D18AA79934}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\32d304dfd2a7b6fc2dbcceca1499e008c447747ef8e83e4f11adce0fcf24d105.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF5EF25D-1110-1029-B63D-43D18AA79934}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6173378F-611E-401B-AAB3-A197DF144470}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\v2\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6173378F-611E-401B-AAB3-A197DF144470}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6173378F-611E-401B-AAB3-A197DF144470}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6173378F-611E-401B-AAB3-A197DF144470}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\32D304~1.DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF5EF25D-1110-1029-B63D-43D18AA79934}\ = "windowsmedia v2 Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6173378F-611E-401B-AAB3-A197DF144470}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\32d304dfd2a7b6fc2dbcceca1499e008c447747ef8e83e4f11adce0fcf24d105.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6D5CDD2-63FF-1DD7-9991-E2C578609F0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6D5CDD2-63FF-1DD7-9991-E2C578609F0F}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF5EF25D-1110-1029-B63D-43D18AA79934}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6173378F-611E-401B-AAB3-A197DF144470}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6D5CDD2-63FF-1DD7-9991-E2C578609F0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\v2.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\v2.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\v2\CLSID\ = "{DF5EF25D-1110-1029-B63D-43D18AA79934}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF5EF25D-1110-1029-B63D-43D18AA79934}\VersionIndependentProgID\ = "windowsmedia v2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF5EF25D-1110-1029-B63D-43D18AA79934}\ProgID\ = "windowsmedia v2.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF5EF25D-1110-1029-B63D-43D18AA79934}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6D5CDD2-63FF-1DD7-9991-E2C578609F0F}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6173378F-611E-401B-AAB3-A197DF144470}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6D5CDD2-63FF-1DD7-9991-E2C578609F0F}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6D5CDD2-63FF-1DD7-9991-E2C578609F0F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6D5CDD2-63FF-1DD7-9991-E2C578609F0F}\TypeLib\ = "{6173378F-611E-401B-AAB3-A197DF144470}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\v2 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\v2\CurVer\ = "windowsmedia v2.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF5EF25D-1110-1029-B63D-43D18AA79934}\TypeLib\ = "{6173378F-611E-401b-AAB3-A197DF144470}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6173378F-611E-401B-AAB3-A197DF144470} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6D5CDD2-63FF-1DD7-9991-E2C578609F0F}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF5EF25D-1110-1029-B63D-43D18AA79934}\ = "Microsoft WindowsMediaPlayer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF5EF25D-1110-1029-B63D-43D18AA79934}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF5EF25D-1110-1029-B63D-43D18AA79934}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF5EF25D-1110-1029-B63D-43D18AA79934}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6173378F-611E-401B-AAB3-A197DF144470}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\v2.1\ = "windowsmedia v2 Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\v2\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF5EF25D-1110-1029-B63D-43D18AA79934} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF5EF25D-1110-1029-B63D-43D18AA79934}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6D5CDD2-63FF-1DD7-9991-E2C578609F0F}\TypeLib regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4868 wrote to memory of 1776 4868 regsvr32.exe 79 PID 4868 wrote to memory of 1776 4868 regsvr32.exe 79 PID 4868 wrote to memory of 1776 4868 regsvr32.exe 79
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\32d304dfd2a7b6fc2dbcceca1499e008c447747ef8e83e4f11adce0fcf24d105.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\32d304dfd2a7b6fc2dbcceca1499e008c447747ef8e83e4f11adce0fcf24d105.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1776
-