Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
7479de29c2c9e15ee09d5f9e7c9807e764f9a09c74b42136cba4af1b0ca7199f.dll
Resource
win7-20220901-en
3 signatures
150 seconds
General
-
Target
7479de29c2c9e15ee09d5f9e7c9807e764f9a09c74b42136cba4af1b0ca7199f.dll
-
Size
53KB
-
MD5
e4e36754395e4110724830d79521fc90
-
SHA1
c4d2aefcc84c831969129a25e1f5d13e1546e7ec
-
SHA256
7479de29c2c9e15ee09d5f9e7c9807e764f9a09c74b42136cba4af1b0ca7199f
-
SHA512
0ddda672d424bce01476606fd0ec1f7d37001fba86c40024f8024158d93fb0b0e3da8c7965602f1d2160168291db255218219b04c6cf29e803417a0eceac5de4
-
SSDEEP
768:GDfN9wiAxAfgsA83/hL9sWx2grEDcn2wAAzpmaNdl7yX:GDHwiAlypsW5O4rdl7yX
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{134DA043-566E-4572-82E6-8978D0ED03D8} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{134DA043-566E-4572-82E6-8978D0ED03D8}\NoExplorer = "1" regsvr32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{134DA043-566E-4572-82E6-8978D0ED03D8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{134DA043-566E-4572-82E6-8978D0ED03D8}\ = "JetMP3" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{134DA043-566E-4572-82E6-8978D0ED03D8}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{134DA043-566E-4572-82E6-8978D0ED03D8}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7479de29c2c9e15ee09d5f9e7c9807e764f9a09c74b42136cba4af1b0ca7199f.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{134DA043-566E-4572-82E6-8978D0ED03D8}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1324 wrote to memory of 828 1324 regsvr32.exe 27 PID 1324 wrote to memory of 828 1324 regsvr32.exe 27 PID 1324 wrote to memory of 828 1324 regsvr32.exe 27 PID 1324 wrote to memory of 828 1324 regsvr32.exe 27 PID 1324 wrote to memory of 828 1324 regsvr32.exe 27 PID 1324 wrote to memory of 828 1324 regsvr32.exe 27 PID 1324 wrote to memory of 828 1324 regsvr32.exe 27
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7479de29c2c9e15ee09d5f9e7c9807e764f9a09c74b42136cba4af1b0ca7199f.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\7479de29c2c9e15ee09d5f9e7c9807e764f9a09c74b42136cba4af1b0ca7199f.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:828
-