Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    154s
  • max time network
    182s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 23:43

General

  • Target

    144a12f29fa82401de92d37853a3bcb8ac98329cd0d80b53b5d4ff16562ea8a2.dll

  • Size

    266KB

  • MD5

    e4fc1083c6ee4d5635908363e881f2c3

  • SHA1

    5f6669daf64dbaa3337eabfda3282bdfe5f0c801

  • SHA256

    144a12f29fa82401de92d37853a3bcb8ac98329cd0d80b53b5d4ff16562ea8a2

  • SHA512

    de862cf58b2357d338372c1b0c85cbb58ea1f9d923f668b69a3d9cc0cfc747e8dc28113bb5d8cd4b6e41b31fbb40ea7dbbae1d619081afa42042ddb4051a338a

  • SSDEEP

    3072:BIy6KX/SC+nUQ0S66vgvy+6/HFEB1RlJG:6y7vAQi+2C10

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies registry class 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\144a12f29fa82401de92d37853a3bcb8ac98329cd0d80b53b5d4ff16562ea8a2.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4452
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\144a12f29fa82401de92d37853a3bcb8ac98329cd0d80b53b5d4ff16562ea8a2.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:964
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 964 -ip 964
    1⤵
      PID:1780

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads