Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 06:44
Behavioral task
behavioral1
Sample
c2f23d1a225350f7ca130772331f8eabc054f727a480fff92507e3ce88853ced.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c2f23d1a225350f7ca130772331f8eabc054f727a480fff92507e3ce88853ced.dll
Resource
win10v2004-20220901-en
General
-
Target
c2f23d1a225350f7ca130772331f8eabc054f727a480fff92507e3ce88853ced.dll
-
Size
128KB
-
MD5
2f259e090a3161d1c21b38be732c3885
-
SHA1
61a9f28f5b99a248d8a74e7a47f3868eb85fda04
-
SHA256
c2f23d1a225350f7ca130772331f8eabc054f727a480fff92507e3ce88853ced
-
SHA512
e8d0d51ba787ec700aa90922e157adbe62c0a6f4ed08eaff934d3f0fc2a15bcd6008ada52137712d1299d7b78793746b1ac7d30b7b0b2c7ed0e32302dad52b08
-
SSDEEP
3072:eNJH83yeup+FbGfcRcYUccsgwyFGma+lskHlf5:elr+RcYUagwyFpa+l5h
Malware Config
Signatures
-
Modifies Shared Task Scheduler registry keys 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler\{FA62EA61-0B84-B73F-D840-61EA62E951D9} rundll32.exe -
resource yara_rule behavioral1/memory/2004-56-0x0000000000690000-0x00000000006F7000-memory.dmp upx behavioral1/memory/2004-57-0x0000000000690000-0x00000000006F7000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{940C840C-A62E-61D9-72EA-0C840C83FB73} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{940C840C-A62E-61D9-72EA-0C840C83FB73}\ rundll32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\NSIYOE.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\NSIYOE.dll rundll32.exe File created C:\Windows\SysWOW64\HMCSIY.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\HMCSIY.dll rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\New Windows\Allow rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\New Windows\Allow\www.google.cn rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\New Windows\Allow\www.baidu.com rundll32.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FA62EA61-0B84-B73F-D840-61EA62E951D9} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{940C840C-A62E-61D9-72EA-0C840C83FB73} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{940C840C-A62E-61D9-72EA-0C840C83FB73}\ rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{940C840C-A62E-61D9-72EA-0C840C83FB73}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{940C840C-A62E-61D9-72EA-0C840C83FB73}\InprocServer32\ = "C:\\Windows\\SysWow64\\HMCSIY.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{940C840C-A62E-61D9-72EA-0C840C83FB73}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FA62EA61-0B84-B73F-D840-61EA62E951D9}\ rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FA62EA61-0B84-B73F-D840-61EA62E951D9}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FA62EA61-0B84-B73F-D840-61EA62E951D9}\InprocServer32\ = "C:\\Windows\\SysWow64\\NSIYOE.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FA62EA61-0B84-B73F-D840-61EA62E951D9}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1956 wrote to memory of 2004 1956 rundll32.exe 28 PID 1956 wrote to memory of 2004 1956 rundll32.exe 28 PID 1956 wrote to memory of 2004 1956 rundll32.exe 28 PID 1956 wrote to memory of 2004 1956 rundll32.exe 28 PID 1956 wrote to memory of 2004 1956 rundll32.exe 28 PID 1956 wrote to memory of 2004 1956 rundll32.exe 28 PID 1956 wrote to memory of 2004 1956 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c2f23d1a225350f7ca130772331f8eabc054f727a480fff92507e3ce88853ced.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c2f23d1a225350f7ca130772331f8eabc054f727a480fff92507e3ce88853ced.dll,#12⤵
- Modifies Shared Task Scheduler registry keys
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:2004
-