Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 01:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
498d71061f3187c19e5f817112bc802a.dll
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
498d71061f3187c19e5f817112bc802a.dll
-
Size
152KB
-
MD5
498d71061f3187c19e5f817112bc802a
-
SHA1
76aeee83a418856baafc769cf9a28bbbaad4529b
-
SHA256
e44ab15a283db160b059afc7fb901072ee7a9819efbf6b4168ccfe29f4c06a42
-
SHA512
e13962a30ec7beacde9c12b51c2cf03d5790c0be6e20947f948613e8cd5fb474dee4c6b4bb688349083adadf31f8f65a49d516b2e6e00ae4d981d88098de8f22
-
SSDEEP
3072:lBu46bH7Tv11xgz2m2P41bXfoVLNroUVfNn:lB+bHZ9Q1bQVLpVf
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0} regsvr32.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system.ini regsvr32.exe -
Modifies registry class 31 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ = "IIEHelperObj2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\ = "{285AB8C5-FB22-4D17-8834-064E2BA0A6F0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\498d71061f3187c19e5f817112bc802a.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\498d71061f3187c19e5f817112bc802a.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\ = "{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\ = "Info cache" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\ = "{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\ = "Pbtoo2s 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ = "IIEHelperObj2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ProxyStubClsid32 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2168 2016 regsvr32.exe 14 PID 2016 wrote to memory of 2168 2016 regsvr32.exe 14 PID 2016 wrote to memory of 2168 2016 regsvr32.exe 14
Processes
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\498d71061f3187c19e5f817112bc802a.dll1⤵
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- Modifies registry class
PID:2168
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\498d71061f3187c19e5f817112bc802a.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2016