Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
21/08/2023, 19:25
Static task
static1
Behavioral task
behavioral1
Sample
9d2e24a7f8804f3a67dda01798d132e64a3e863f3654de4bdf13f37b23387ad6.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
9d2e24a7f8804f3a67dda01798d132e64a3e863f3654de4bdf13f37b23387ad6.dll
Resource
win10v2004-20230703-en
General
-
Target
9d2e24a7f8804f3a67dda01798d132e64a3e863f3654de4bdf13f37b23387ad6.dll
-
Size
865KB
-
MD5
1b011aa5f2d0f99db3d97fd18d5632bf
-
SHA1
2dfe2b8ff531371dcff57e9613dd41cff6e440f0
-
SHA256
9d2e24a7f8804f3a67dda01798d132e64a3e863f3654de4bdf13f37b23387ad6
-
SHA512
fefb25492d4b7178f19a5a0e473732c752c6faa6ace36948eb3ed2d0a52c1f4f9f7b295077b20e3997a5f781a1e83193ca163b78b8b087364ca701c61c8dcf58
-
SSDEEP
12288:3nFO/kOTK/de9rNu2V3uvv+l48ZIpBqEfVuHecJMxHP:3nFO/VTK/de9rNEvnIcVitMx
Malware Config
Signatures
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0002DF05-0000-0000-C000-000000000046}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{729FE2F8-1EA8-11D1-8F85-00C04FC2FBE1} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BA9239A4-3DD5-11D2-BF8B-00C04FB93661}\ProxyStubClsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA1}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{729FE2F8-1EA8-11D1-8F85-00C04FC2FBE1}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{55136806-B2DE-11D1-B9F2-00A0C98BC547} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA1}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1611FDDA-445B-11D2-85DE-00C04FA35C89}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E572D3C9-37BE-4AE2-825D-D521763E3108} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA2}\ProxyStubClsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1611FDDA-445B-11D2-85DE-00C04FA35C89}\ = "_SearchAssistantEvents" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.URL\ShellEx\{00021500-0000-0000-C000-000000000046} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{47C922A2-3DD5-11D2-BF8B-00C04FB93661}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC\ = "SearchAssistantOC" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC\CLSID\ = "{B45FF030-4447-11D2-85DE-00C04FA35C89}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.URL regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAB22AC2-30C1-11CF-A7EB-0000C05BAE0B}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\TypeLib\ = "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D}\VersionIndependentProgId\ = "SearchAssistantOC.SearchAssistantOC" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.URL\PersistentHandler regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{47C922A2-3DD5-11D2-BF8B-00C04FB93661}\TypeLib\ = "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3470F24-15FD-11D2-BB2E-00805FF7EFCA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC\CLSID\ = "{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{34A715A0-6587-11D0-924A-0020AFC7AC4D}\ProxyStubClsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\https\URL Protocol regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA1}\ProxyStubClsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA3}\TypeLib\Version = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1611FDDA-445B-11D2-85DE-00C04FA35C89}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC.1\CLSID\ = "{B45FF030-4447-11D2-85DE-00C04FA35C89}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\EditFlags = "2" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.URL\ShellEx\{CABB0DA0-DA57-11CF-9974-0020AFD79762} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA3}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{85CB6900-4D95-11CF-960C-0080C7F4EE85} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{47C922A2-3DD5-11D2-BF8B-00C04FB93661}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\VersionIndependentProgId\ = "SearchAssistantOC.SearchAssistantOC" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA1}\ = "ISearchAssistantOC" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA3}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\ = "Shell Name Space" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC\CurVer\ = "SearchAssistantOC.SearchAssistantOC.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D}\VersionIndependentProgId regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\ProgId\ = "SearchAssistantOC.SearchAssistantOC.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\ = "Internet Shortcut" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{55136804-B2DE-11D1-B9F2-00A0C98BC547} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{47C922A2-3DD5-11D2-BF8B-00C04FB93661}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA2}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1611FDDA-445B-11D2-85DE-00C04FA35C89}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\Version regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2548 2476 regsvr32.exe 28 PID 2476 wrote to memory of 2548 2476 regsvr32.exe 28 PID 2476 wrote to memory of 2548 2476 regsvr32.exe 28 PID 2476 wrote to memory of 2548 2476 regsvr32.exe 28 PID 2476 wrote to memory of 2548 2476 regsvr32.exe 28 PID 2476 wrote to memory of 2548 2476 regsvr32.exe 28 PID 2476 wrote to memory of 2548 2476 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\9d2e24a7f8804f3a67dda01798d132e64a3e863f3654de4bdf13f37b23387ad6.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\9d2e24a7f8804f3a67dda01798d132e64a3e863f3654de4bdf13f37b23387ad6.dll2⤵
- Modifies registry class
PID:2548
-