Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    45s
  • max time network
    51s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2022, 13:34

General

  • Target

    d45405ecbb71735bc4f3aac9a4f19dd157d3e5d630d5790b3a2a5eef109d3016.dll

  • Size

    210KB

  • MD5

    52102eafcae7a98637ec5b6f2af2aee8

  • SHA1

    d15408b5a97f3705290d887fdf1a3de0f9f1fca6

  • SHA256

    d45405ecbb71735bc4f3aac9a4f19dd157d3e5d630d5790b3a2a5eef109d3016

  • SHA512

    89482b60b71905b2f6e0bf4f8beefc1409d56faecf27930bf9479d12591f5e4d95c6f59f76324cd1c9db60e807647323c78cea46b01a8ac13301016bb2e20ce5

  • SSDEEP

    3072:Iyt2kDRiBykHdAcMjWLDLPAdZVxhlcEQqlP+B:Iyt5ZeHPKcBV

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies registry class 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d45405ecbb71735bc4f3aac9a4f19dd157d3e5d630d5790b3a2a5eef109d3016.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\d45405ecbb71735bc4f3aac9a4f19dd157d3e5d630d5790b3a2a5eef109d3016.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:1148

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1148-56-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

    Filesize

    8KB

  • memory/1308-54-0x000007FEFB651000-0x000007FEFB653000-memory.dmp

    Filesize

    8KB