Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 12:21
Static task
static1
Behavioral task
behavioral1
Sample
f4a59ac4af109f122a6b83eea408d75e80bd6f445eccfee75a6361152ee6fb6e.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f4a59ac4af109f122a6b83eea408d75e80bd6f445eccfee75a6361152ee6fb6e.dll
Resource
win10v2004-20221111-en
General
-
Target
f4a59ac4af109f122a6b83eea408d75e80bd6f445eccfee75a6361152ee6fb6e.dll
-
Size
340KB
-
MD5
3bef6a79ea82fe38f5843f3688f17e20
-
SHA1
1ec4c75fbb03f9faeeec6291f0086454bbde7208
-
SHA256
f4a59ac4af109f122a6b83eea408d75e80bd6f445eccfee75a6361152ee6fb6e
-
SHA512
caf1cf5b643c822f903d7351549dd6e2f3242c306d53c8585c2fcdeb769915a9338cfd1d91fa304683e0fd47079527c25970ac5e57d89df5d518bce4ac3b8463
-
SSDEEP
6144:Gad0uIojPT5ChuB8Vn3hgIRDm7iNZkcgp2YIxxfE2yM35ja5:hd0ujFCEB81tRFNZxWBIxujh5
Malware Config
Signatures
-
Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{957B54A2-5E9C-48A5-84BC-6834032328A3}\ = "IAEPlugIn" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{957B54A2-5E9C-48A5-84BC-6834032328A3}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mmAEPlugIn.AEPlugIn\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mmAEPlugIn.AEPlugIn\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8C31D11-6FD2-4659-AD75-155FA143F42B}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8C31D11-6FD2-4659-AD75-155FA143F42B}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{44C79591-D0DE-49C4-BA3C-A45AB7003356}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f4a59ac4af109f122a6b83eea408d75e80bd6f445eccfee75a6361152ee6fb6e.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8C31D11-6FD2-4659-AD75-155FA143F42B}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8C31D11-6FD2-4659-AD75-155FA143F42B}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{44C79591-D0DE-49C4-BA3C-A45AB7003356}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mmAEPlugIn.AEPlugIn.1\ = "AEPlugIn Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mmAEPlugIn.AEPlugIn regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mmAEPlugIn.AEPlugIn\CLSID\ = "{E8C31D11-6FD2-4659-AD75-155FA143F42B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8C31D11-6FD2-4659-AD75-155FA143F42B}\ = "AEPlugIn Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8C31D11-6FD2-4659-AD75-155FA143F42B}\ProgID\ = "mmAEPlugIn.AEPlugIn.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{957B54A2-5E9C-48A5-84BC-6834032328A3}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{957B54A2-5E9C-48A5-84BC-6834032328A3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{957B54A2-5E9C-48A5-84BC-6834032328A3}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mmAEPlugIn.AEPlugIn.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mmAEPlugIn.AEPlugIn.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mmAEPlugIn.AEPlugIn\ = "AEPlugIn Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8C31D11-6FD2-4659-AD75-155FA143F42B}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{957B54A2-5E9C-48A5-84BC-6834032328A3}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{957B54A2-5E9C-48A5-84BC-6834032328A3}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8C31D11-6FD2-4659-AD75-155FA143F42B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F4A59A~1.DLL" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8C31D11-6FD2-4659-AD75-155FA143F42B}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{44C79591-D0DE-49C4-BA3C-A45AB7003356}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{44C79591-D0DE-49C4-BA3C-A45AB7003356}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{957B54A2-5E9C-48A5-84BC-6834032328A3}\ = "IAEPlugIn" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mmAEPlugIn.AEPlugIn\CurVer\ = "mmAEPlugIn.AEPlugIn.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{44C79591-D0DE-49C4-BA3C-A45AB7003356}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{44C79591-D0DE-49C4-BA3C-A45AB7003356}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{957B54A2-5E9C-48A5-84BC-6834032328A3} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mmAEPlugIn.AEPlugIn.1\CLSID\ = "{E8C31D11-6FD2-4659-AD75-155FA143F42B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8C31D11-6FD2-4659-AD75-155FA143F42B}\VersionIndependentProgID\ = "mmAEPlugIn.AEPlugIn" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{44C79591-D0DE-49C4-BA3C-A45AB7003356} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{44C79591-D0DE-49C4-BA3C-A45AB7003356}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{44C79591-D0DE-49C4-BA3C-A45AB7003356}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{957B54A2-5E9C-48A5-84BC-6834032328A3}\TypeLib\ = "{44C79591-D0DE-49C4-BA3C-A45AB7003356}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8C31D11-6FD2-4659-AD75-155FA143F42B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8C31D11-6FD2-4659-AD75-155FA143F42B}\TypeLib\ = "{44C79591-D0DE-49c4-BA3C-A45AB7003356}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{44C79591-D0DE-49C4-BA3C-A45AB7003356}\1.0\ = "mmAEPlugIn 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{957B54A2-5E9C-48A5-84BC-6834032328A3}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{957B54A2-5E9C-48A5-84BC-6834032328A3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{957B54A2-5E9C-48A5-84BC-6834032328A3}\TypeLib\ = "{44C79591-D0DE-49C4-BA3C-A45AB7003356}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{957B54A2-5E9C-48A5-84BC-6834032328A3} regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 400 wrote to memory of 2032 400 regsvr32.exe 82 PID 400 wrote to memory of 2032 400 regsvr32.exe 82 PID 400 wrote to memory of 2032 400 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f4a59ac4af109f122a6b83eea408d75e80bd6f445eccfee75a6361152ee6fb6e.dll1⤵
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\f4a59ac4af109f122a6b83eea408d75e80bd6f445eccfee75a6361152ee6fb6e.dll2⤵
- Modifies registry class
PID:2032
-