Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
188s -
max time network
214s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 11:26
Static task
static1
Behavioral task
behavioral1
Sample
9a6103b07715d1607732053532826f27106c298c2ff26bf57b3c8112086dc5ea.dll
Resource
win7-20221111-en
4 signatures
150 seconds
General
-
Target
9a6103b07715d1607732053532826f27106c298c2ff26bf57b3c8112086dc5ea.dll
-
Size
52KB
-
MD5
c29d737251349424170d4ff7c23df950
-
SHA1
0967cef9b445b07bfedac121b2c37616b1be12d7
-
SHA256
9a6103b07715d1607732053532826f27106c298c2ff26bf57b3c8112086dc5ea
-
SHA512
2d98be633cdfdad336770a63085b72034d653c30a7333b5f8d3310371d52b9419b3c0b78509178847a6aee4ddfda32812da92f70992f01ce5d96da3ad3934178
-
SSDEEP
1536:lc7wP6rrFBnHUzKP5vzGw7nqgTPe7nXDPvBBtWXjY:Iw6rrFBnmklCBtyjY
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7BA4C38C-6BE5-4F3C-980B-CEB48A777413} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7BA4C38C-6BE5-4F3C-980B-CEB48A777413}\NoExplorer = "1" regsvr32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3096 4684 WerFault.exe 85 -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6C08444C-B736-4C01-99A8-4CC9E59A9BC9}\DisplayName = "Google" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6C08444C-B736-4C01-99A8-4CC9E59A9BC9}\URL = "http://www.gggdu.com/google?q={searchTerms}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\SearchScopes regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{20C3857E-3A7A-48FF-8C16-8BAFFDF5EE77}" regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{20C3857E-3A7A-48FF-8C16-8BAFFDF5EE77}\URL = "http://www.baidu.com/s?tn=leizhen_dg&ie=utf-8&wd={searchTerms}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6C08444C-B736-4C01-99A8-4CC9E59A9BC9} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\SearchScopes\{20C3857E-3A7A-48FF-8C16-8BAFFDF5EE77} regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{20C3857E-3A7A-48FF-8C16-8BAFFDF5EE77}\DisplayName = "°Ù¶È" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{20C3857E-3A7A-48FF-8C16-8BAFFDF5EE77}\SuggestionsURL_JSON = "http://suggestion.baidu.com/su?wd={searchTerms}&action=opensearch&ie=utf-8&from=ie8" regsvr32.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BA4C38C-6BE5-4F3C-980B-CEB48A777413} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shell\OpenHomePage regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BA4C38C-6BE5-4F3C-980B-CEB48A777413}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shell regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\DefaultIcon regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BA4C38C-6BE5-4F3C-980B-CEB48A777413}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9a6103b07715d1607732053532826f27106c298c2ff26bf57b3c8112086dc5ea.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shell\OpenHomePage\Command regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3272 wrote to memory of 4684 3272 regsvr32.exe 85 PID 3272 wrote to memory of 4684 3272 regsvr32.exe 85 PID 3272 wrote to memory of 4684 3272 regsvr32.exe 85
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\9a6103b07715d1607732053532826f27106c298c2ff26bf57b3c8112086dc5ea.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\9a6103b07715d1607732053532826f27106c298c2ff26bf57b3c8112086dc5ea.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:4684 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 8403⤵
- Program crash
PID:3096
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4684 -ip 46841⤵PID:3376