Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
27s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
20/12/2022, 19:44
Static task
static1
Behavioral task
behavioral1
Sample
0ce45fe45dd2b78f36fd75e6d039317c4fa54ce2ba9dc82b4f42d532d80a0531.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0ce45fe45dd2b78f36fd75e6d039317c4fa54ce2ba9dc82b4f42d532d80a0531.dll
Resource
win10v2004-20221111-en
General
-
Target
0ce45fe45dd2b78f36fd75e6d039317c4fa54ce2ba9dc82b4f42d532d80a0531.dll
-
Size
80KB
-
MD5
672c25d9d70f3c6069ac69e7d8900c44
-
SHA1
3d4ce60fe84612383a76d3b8ff5b6eaaafd77f11
-
SHA256
0ce45fe45dd2b78f36fd75e6d039317c4fa54ce2ba9dc82b4f42d532d80a0531
-
SHA512
c31258717e899aec049ff8b84376e46a0b281e5d214d3093e5d925a796f8c472d153da60c8c991a3752edf1d429922cf765fa6ba38f475abefa9f44ebecb6dee
-
SSDEEP
768:7kyMTgHs6AJnf+oZzF7yxPMHjfnC74Ko9A3jC2rkbX9QqLWWt0pXzP2UKv9vb1n0:7kyMTgM1Jnf5FTDKoKCuu9QAdAAl/Du
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2008 DPGLic.exe -
Loads dropped DLL 2 IoCs
pid Process 2040 regsvr32.exe 2040 regsvr32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1980 wrote to memory of 2040 1980 regsvr32.exe 27 PID 1980 wrote to memory of 2040 1980 regsvr32.exe 27 PID 1980 wrote to memory of 2040 1980 regsvr32.exe 27 PID 1980 wrote to memory of 2040 1980 regsvr32.exe 27 PID 1980 wrote to memory of 2040 1980 regsvr32.exe 27 PID 1980 wrote to memory of 2040 1980 regsvr32.exe 27 PID 1980 wrote to memory of 2040 1980 regsvr32.exe 27 PID 2040 wrote to memory of 2008 2040 regsvr32.exe 28 PID 2040 wrote to memory of 2008 2040 regsvr32.exe 28 PID 2040 wrote to memory of 2008 2040 regsvr32.exe 28 PID 2040 wrote to memory of 2008 2040 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0ce45fe45dd2b78f36fd75e6d039317c4fa54ce2ba9dc82b4f42d532d80a0531.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0ce45fe45dd2b78f36fd75e6d039317c4fa54ce2ba9dc82b4f42d532d80a0531.dll2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\DPGLic.exeC:\Users\Admin\AppData\Local\Temp\DPGLic.exe3⤵
- Executes dropped EXE
PID:2008
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD5b624242e7d33bf16e07aa3025cf3a526
SHA134e3f465ec4fd14d25bf5416f28f7e7d5952f39a
SHA256b800480175d41b937bdf15bcd8cf7f28f3b8e8e97221c8cfeeb6c1f2c794c2f0
SHA512b02bf6705921abc6b9e75e08a6bd76e0748fa76eba5f4f5bcd281484b924e2a9351f854ac93e6b6a3fc59f29e1c1086cd4b270eff5c962f464f771623c1e2760
-
Filesize
27KB
MD5b624242e7d33bf16e07aa3025cf3a526
SHA134e3f465ec4fd14d25bf5416f28f7e7d5952f39a
SHA256b800480175d41b937bdf15bcd8cf7f28f3b8e8e97221c8cfeeb6c1f2c794c2f0
SHA512b02bf6705921abc6b9e75e08a6bd76e0748fa76eba5f4f5bcd281484b924e2a9351f854ac93e6b6a3fc59f29e1c1086cd4b270eff5c962f464f771623c1e2760
-
Filesize
27KB
MD5b624242e7d33bf16e07aa3025cf3a526
SHA134e3f465ec4fd14d25bf5416f28f7e7d5952f39a
SHA256b800480175d41b937bdf15bcd8cf7f28f3b8e8e97221c8cfeeb6c1f2c794c2f0
SHA512b02bf6705921abc6b9e75e08a6bd76e0748fa76eba5f4f5bcd281484b924e2a9351f854ac93e6b6a3fc59f29e1c1086cd4b270eff5c962f464f771623c1e2760