Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 19:25
Static task
static1
Behavioral task
behavioral1
Sample
9d2e24a7f8804f3a67dda01798d132e64a3e863f3654de4bdf13f37b23387ad6.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
9d2e24a7f8804f3a67dda01798d132e64a3e863f3654de4bdf13f37b23387ad6.dll
Resource
win10v2004-20230703-en
General
-
Target
9d2e24a7f8804f3a67dda01798d132e64a3e863f3654de4bdf13f37b23387ad6.dll
-
Size
865KB
-
MD5
1b011aa5f2d0f99db3d97fd18d5632bf
-
SHA1
2dfe2b8ff531371dcff57e9613dd41cff6e440f0
-
SHA256
9d2e24a7f8804f3a67dda01798d132e64a3e863f3654de4bdf13f37b23387ad6
-
SHA512
fefb25492d4b7178f19a5a0e473732c752c6faa6ace36948eb3ed2d0a52c1f4f9f7b295077b20e3997a5f781a1e83193ca163b78b8b087364ca701c61c8dcf58
-
SSDEEP
12288:3nFO/kOTK/de9rNu2V3uvv+l48ZIpBqEfVuHecJMxHP:3nFO/VTK/de9rNEvnIcVitMx
Malware Config
Signatures
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64AB4BB7-111E-11d1-8F79-00C04FC2FBE1} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\TypeLib\ = "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE4106E0-399A-11D0-A48C-00A0C90A8F39}\ProxyStubClsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47C922A2-3DD5-11D2-BF8B-00C04FB93661}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAB22AC1-30C1-11CF-A7EB-0000C05BAE0B}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1611FDDA-445B-11D2-85DE-00C04FA35C89}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9d2e24a7f8804f3a67dda01798d132e64a3e863f3654de4bdf13f37b23387ad6.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47C922A2-3DD5-11D2-BF8B-00C04FB93661}\ = "ISearches" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA1} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1611FDDA-445B-11D2-85DE-00C04FA35C89}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64AB4BB7-111E-11d1-8F79-00C04FC2FBE1}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E572D3C9-37BE-4AE2-825D-D521763E3108}\ProxyStubClsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BA9239A4-3DD5-11D2-BF8B-00C04FB93661}\TypeLib\Version = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC.1\CLSID\ = "{B45FF030-4447-11D2-85DE-00C04FA35C89}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA2}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\Version\ = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC.1 regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\mailto\URL Protocol regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55136804-B2DE-11D1-B9F2-00A0C98BC547}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA3} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1611FDDA-445B-11D2-85DE-00C04FA35C89} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1611FDDA-445B-11D2-85DE-00C04FA35C89}\ = "_SearchAssistantEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D}\VersionIndependentProgId\ = "SearchAssistantOC.SearchAssistantOC" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D}\VersionIndependentProgId regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\NeverShowExt regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAB22AC1-30C1-11CF-A7EB-0000C05BAE0B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA2}\ = "ISearchAssistantOC2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA3}\TypeLib\ = "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D}\ProgId\ = "SearchAssistantOC.SearchAssistantOC.1" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\http\URL Protocol regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA2} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64AB4BB7-111E-11d1-8F79-00C04FC2FBE1}\VersionIndependentProgId regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BA9239A4-3DD5-11D2-BF8B-00C04FB93661}\TypeLib\ = "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA1}\ = "ISearchAssistantOC" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\DefaultIcon\ = "url.dll,0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34A715A0-6587-11D0-924A-0020AFC7AC4D}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{729FE2F8-1EA8-11D1-8F85-00C04FC2FBE1} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A7FE6EDA-1932-4281-B881-87B31B8BC52C}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55136806-B2DE-11D1-B9F2-00A0C98BC547} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA1}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC\CLSID\ = "{B45FF030-4447-11D2-85DE-00C04FA35C89}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC\CurVer\ = "SearchAssistantOC.SearchAssistantOC.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAB22AC2-30C1-11CF-A7EB-0000C05BAE0B}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA3}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA3}\TypeLib\Version = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55136805-B2DE-11D1-B9F2-00A0C98BC547}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D}\TypeLib\ = "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\ProgId regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.URL\OpenWithProgIds regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.URL\ShellEx regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47C922A2-3DD5-11D2-BF8B-00C04FB93661} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA1}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34A715A0-6587-11D0-924A-0020AFC7AC4D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA3}\ = "ISearchAssistantOC3" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2916 wrote to memory of 4516 2916 regsvr32.exe 81 PID 2916 wrote to memory of 4516 2916 regsvr32.exe 81 PID 2916 wrote to memory of 4516 2916 regsvr32.exe 81
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\9d2e24a7f8804f3a67dda01798d132e64a3e863f3654de4bdf13f37b23387ad6.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\9d2e24a7f8804f3a67dda01798d132e64a3e863f3654de4bdf13f37b23387ad6.dll2⤵
- Modifies registry class
PID:4516
-