Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
18/09/2023, 02:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d1990ee08d516902cd4a721183b09447c515cbbeedd57bb5e327a0a637c6c9a.exe
Resource
win7-20230831-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
4d1990ee08d516902cd4a721183b09447c515cbbeedd57bb5e327a0a637c6c9a.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
4d1990ee08d516902cd4a721183b09447c515cbbeedd57bb5e327a0a637c6c9a.exe
-
Size
1.9MB
-
MD5
f46ca734283cd60869480ba788f4b458
-
SHA1
305d56faf5d04149ca8816b3cb64fc3fb0c663a4
-
SHA256
4d1990ee08d516902cd4a721183b09447c515cbbeedd57bb5e327a0a637c6c9a
-
SHA512
5d716dac5d8c86752fe9d88202a3480ccba4dfa5e72ffb78755588ee17f7ca6b2a9b501e182944ccb3c86b7ae2fd0c52857beecd4cb4cae2779355fb0c9a5f7b
-
SSDEEP
49152:w3InZZu/2nnuO5oKZenU7CvCqLfqSH4BSbJ1vGEOVb0:YIZZu/2nnuO7UgCKgSSH4BAJlJa0
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00060000000120e4-1.dat acprotect behavioral1/files/0x00060000000120e4-2.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2892 regsvr32.exe -
resource yara_rule behavioral1/files/0x00060000000120e4-1.dat upx behavioral1/memory/2892-3-0x0000000010000000-0x000000001017A000-memory.dmp upx behavioral1/files/0x00060000000120e4-2.dat upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\dm.dll 4d1990ee08d516902cd4a721183b09447c515cbbeedd57bb5e327a0a637c6c9a.exe -
Modifies registry class 37 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ = "Idmsoft" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\ = "{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ = "dm.dmsoft" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\ = "Dm" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ProgID\ = "dm.dmsoft" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ = "Idmsoft" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CLSID\ = "{26037A0E-7CBD-4FFF-9C63-56F2D0770214}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CurVer\ = "dm.dmsoft" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\ = "{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\dm.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32\ = "C:\\Windows\\SysWow64\\dm.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\ = "dm.dmsoft" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1936 4d1990ee08d516902cd4a721183b09447c515cbbeedd57bb5e327a0a637c6c9a.exe 1936 4d1990ee08d516902cd4a721183b09447c515cbbeedd57bb5e327a0a637c6c9a.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2892 1936 4d1990ee08d516902cd4a721183b09447c515cbbeedd57bb5e327a0a637c6c9a.exe 28 PID 1936 wrote to memory of 2892 1936 4d1990ee08d516902cd4a721183b09447c515cbbeedd57bb5e327a0a637c6c9a.exe 28 PID 1936 wrote to memory of 2892 1936 4d1990ee08d516902cd4a721183b09447c515cbbeedd57bb5e327a0a637c6c9a.exe 28 PID 1936 wrote to memory of 2892 1936 4d1990ee08d516902cd4a721183b09447c515cbbeedd57bb5e327a0a637c6c9a.exe 28 PID 1936 wrote to memory of 2892 1936 4d1990ee08d516902cd4a721183b09447c515cbbeedd57bb5e327a0a637c6c9a.exe 28 PID 1936 wrote to memory of 2892 1936 4d1990ee08d516902cd4a721183b09447c515cbbeedd57bb5e327a0a637c6c9a.exe 28 PID 1936 wrote to memory of 2892 1936 4d1990ee08d516902cd4a721183b09447c515cbbeedd57bb5e327a0a637c6c9a.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d1990ee08d516902cd4a721183b09447c515cbbeedd57bb5e327a0a637c6c9a.exe"C:\Users\Admin\AppData\Local\Temp\4d1990ee08d516902cd4a721183b09447c515cbbeedd57bb5e327a0a637c6c9a.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 C:\Windows\system32\dm.dll /s2⤵
- Loads dropped DLL
- Modifies registry class
PID:2892
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
821KB
MD5459b11596d6532bbc46f15b371810ab5
SHA1ae66b39e4f5b28cbf2e68cbf90223cec63241a56
SHA2569737b8480c6fb3facd8e5d325477cbe15f0404688b03f47fa2736757b6215d5d
SHA51286fb19a0fcc613b55da0694b5943993d96a3f36e9840e05248cb5dca80b7c553cb5772db1284304944be53ebe84036338ea8ffa83fe65c23a8ec4650ac9435b4
-
Filesize
821KB
MD5459b11596d6532bbc46f15b371810ab5
SHA1ae66b39e4f5b28cbf2e68cbf90223cec63241a56
SHA2569737b8480c6fb3facd8e5d325477cbe15f0404688b03f47fa2736757b6215d5d
SHA51286fb19a0fcc613b55da0694b5943993d96a3f36e9840e05248cb5dca80b7c553cb5772db1284304944be53ebe84036338ea8ffa83fe65c23a8ec4650ac9435b4