Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
01/07/2023, 21:57
Static task
static1
Behavioral task
behavioral1
Sample
3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd.dll
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd.dll
Resource
win10v2004-20230621-en
General
-
Target
3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd.dll
-
Size
391KB
-
MD5
1fe5472c751356df0c20f05cad59509d
-
SHA1
2877b8711537e19b175c6fdc518b75a592245c3e
-
SHA256
3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd
-
SHA512
9324b969511970103c3d2fc00c379972a087db37c913b5d01a0685e1945d819e2ace530b744708ee6d6ed60872f359675768d6c0b59498257d73717c5b1cb6a2
-
SSDEEP
12288:yvO+MmUf61QCCt4oAtxRxp0zUOA1sUZb7m0PG6K:yv3MmUf6WCc4orQOA1sUZb7m0PrK
Malware Config
Signatures
-
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}\ = "zShut" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B9E8E846-BBD1-4BE5-9C7F-D8813F8EA7C7}\Implemented Categories\{00021492-0000-0000-C000-000000000046} regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2012 wrote to memory of 2032 2012 regsvr32.exe 28 PID 2012 wrote to memory of 2032 2012 regsvr32.exe 28 PID 2012 wrote to memory of 2032 2012 regsvr32.exe 28 PID 2012 wrote to memory of 2032 2012 regsvr32.exe 28 PID 2012 wrote to memory of 2032 2012 regsvr32.exe 28 PID 2012 wrote to memory of 2032 2012 regsvr32.exe 28 PID 2012 wrote to memory of 2032 2012 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\3cb00ed4fd4f1d746c5b8618d8a52af11a47cb8ac464190f96abbaab500e1ddd.dll2⤵
- Modifies registry class
PID:2032
-