Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 13:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1a309596c9bb24df4a97b6a2fb3967bf.dll
Resource
win7-20231129-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
1a309596c9bb24df4a97b6a2fb3967bf.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
1a309596c9bb24df4a97b6a2fb3967bf.dll
-
Size
472KB
-
MD5
1a309596c9bb24df4a97b6a2fb3967bf
-
SHA1
75677094b4b78bbe0e07b5c35f1a371d14cd1d57
-
SHA256
c75ce9d9dc660ddc87b315dd90ee11f70a88ac78cfd82008958f102e9a8c9bc5
-
SHA512
6040a5314ee5db4737f07c5ad90edd8d5713a481a5718067d4695b46b1871cddd2735f3059a567cb57de733884d10eff4872f91a6d16cabaf91f1f1be4feaf1b
-
SSDEEP
12288:gIx3n4BiTNvjrwy15K1Q4e0TsSk7h77wNpTYLb8:gIx3JNLrr5KbQ/7h7S4
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 341d.exe -
Executes dropped EXE 4 IoCs
pid Process 1336 341d.exe 648 341d.exe 3392 341d.exe 2808 mtv.exe -
Loads dropped DLL 32 IoCs
pid Process 4976 regsvr32.exe 3392 341d.exe 3304 rundll32.exe 4776 rundll32.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe 3392 341d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\plc = "c:\\windows\\system32\\rundll32.exe C:\\Windows\\system32/341e.dll,Always" rundll32.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCAA0766-15FC-4aec-A010-F4605D272581} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCAA0766-15FC-4aec-A010-F4605D272581}\ regsvr32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe File opened for modification \??\PhysicalDrive0 341d.exe File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\b34o.dlltmp rundll32.exe File opened for modification C:\Windows\SysWOW64\s.exe mtv.exe File opened for modification C:\Windows\SysWOW64\eee rundll32.exe File opened for modification C:\Windows\SysWOW64\a1l8.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\1ba4.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\34ua.exe rundll32.exe File opened for modification C:\Windows\SysWOW64\341e.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\341d.exe rundll32.exe File created C:\Windows\SysWOW64\-87-56-77121 rundll32.exe File created C:\Windows\SysWOW64\1766 rundll32.exe File opened for modification C:\Windows\SysWOW64\3bef.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\a1l8.dlltmp rundll32.exe File opened for modification C:\Windows\SysWOW64\b4cb.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\b4cb.dlltmp rundll32.exe File opened for modification C:\Windows\SysWOW64\144d.exe rundll32.exe File opened for modification C:\Windows\SysWOW64\4f3r.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\4f3r.dlltmp rundll32.exe File opened for modification C:\Windows\SysWOW64\14rb.exe rundll32.exe File opened for modification C:\Windows\SysWOW64\b3fs.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\b34o.dll rundll32.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\a34b.flv rundll32.exe File opened for modification C:\Windows\f6f.bmp rundll32.exe File opened for modification C:\Windows\ba8d.flv rundll32.exe File opened for modification C:\Windows\bf14.bmp rundll32.exe File opened for modification C:\Windows\14ba.exe rundll32.exe File opened for modification C:\Windows\6f1u.bmp rundll32.exe File opened for modification C:\Windows\a8fd.exe rundll32.exe File opened for modification C:\Windows\4bad.flv rundll32.exe File opened for modification C:\Windows\8f6.exe rundll32.exe File opened for modification C:\Windows\a8f.flv rundll32.exe File opened for modification C:\Windows\ba8u.bmp rundll32.exe File opened for modification C:\Windows\ba8d.exe rundll32.exe File created C:\Windows\Tasks\ms.job rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 47 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\ = "IFffPlayer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\CLSID\ = "{FCAA0766-15FC-4aec-A010-F4605D272581}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\ = "CFffPlayer Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\VersionIndependentProgID\ = "BHO.FffPlayer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\AppID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\TypeLib\ = "{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\ = "CFffPlayer Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\ProgID\ = "BHO.FffPlayer.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\InprocServer32\ThreadingModel = "apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\InprocServer32\ = "C:\\Windows\\SysWow64\\b34o.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer.1\CLSID\ = "{FCAA0766-15FC-4aec-A010-F4605D272581}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\b34o.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer.1\ = "CFffPlayer Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\CurVer\ = "BHO.FffPlayer.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\TypeLib\ = "{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\TypeLib\ = "{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\ = "IFffPlayer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\ = "BHO 1.0 Type Library" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3392 341d.exe 3392 341d.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2808 mtv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1556 wrote to memory of 3248 1556 rundll32.exe 14 PID 1556 wrote to memory of 3248 1556 rundll32.exe 14 PID 1556 wrote to memory of 3248 1556 rundll32.exe 14 PID 3248 wrote to memory of 2040 3248 rundll32.exe 17 PID 3248 wrote to memory of 2040 3248 rundll32.exe 17 PID 3248 wrote to memory of 2040 3248 rundll32.exe 17 PID 3248 wrote to memory of 2188 3248 rundll32.exe 29 PID 3248 wrote to memory of 2188 3248 rundll32.exe 29 PID 3248 wrote to memory of 2188 3248 rundll32.exe 29 PID 3248 wrote to memory of 3620 3248 rundll32.exe 18 PID 3248 wrote to memory of 3620 3248 rundll32.exe 18 PID 3248 wrote to memory of 3620 3248 rundll32.exe 18 PID 3248 wrote to memory of 4848 3248 rundll32.exe 19 PID 3248 wrote to memory of 4848 3248 rundll32.exe 19 PID 3248 wrote to memory of 4848 3248 rundll32.exe 19 PID 3248 wrote to memory of 4976 3248 rundll32.exe 26 PID 3248 wrote to memory of 4976 3248 rundll32.exe 26 PID 3248 wrote to memory of 4976 3248 rundll32.exe 26 PID 3248 wrote to memory of 1336 3248 rundll32.exe 22 PID 3248 wrote to memory of 1336 3248 rundll32.exe 22 PID 3248 wrote to memory of 1336 3248 rundll32.exe 22 PID 3248 wrote to memory of 648 3248 rundll32.exe 25 PID 3248 wrote to memory of 648 3248 rundll32.exe 25 PID 3248 wrote to memory of 648 3248 rundll32.exe 25 PID 3392 wrote to memory of 3304 3392 341d.exe 38 PID 3392 wrote to memory of 3304 3392 341d.exe 38 PID 3392 wrote to memory of 3304 3392 341d.exe 38 PID 3248 wrote to memory of 2808 3248 rundll32.exe 40 PID 3248 wrote to memory of 2808 3248 rundll32.exe 40 PID 3248 wrote to memory of 2808 3248 rundll32.exe 40 PID 3248 wrote to memory of 4776 3248 rundll32.exe 39 PID 3248 wrote to memory of 4776 3248 rundll32.exe 39 PID 3248 wrote to memory of 4776 3248 rundll32.exe 39
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1a309596c9bb24df4a97b6a2fb3967bf.dll,#11⤵
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/a1l8.dll"2⤵PID:2040
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/4f3r.dll"2⤵PID:3620
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/b34o.dll"2⤵PID:4848
-
-
C:\Windows\SysWOW64\341d.exeC:\Windows\system32/341d.exe -i2⤵
- Executes dropped EXE
PID:1336
-
-
C:\Windows\SysWOW64\341d.exeC:\Windows\system32/341d.exe -s2⤵
- Executes dropped EXE
PID:648
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s "C:\Windows\system32/b34o.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:4976
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/b4cb.dll"2⤵PID:2188
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32 C:\Windows\system32/341e.dll, Always2⤵
- Loads dropped DLL
PID:4776
-
-
C:\Users\Admin\AppData\Local\Temp\h8nil4o8\mtv.exeC:\Users\Admin\AppData\Local\Temp\h8nil4o8\mtv.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2808
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1a309596c9bb24df4a97b6a2fb3967bf.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1556
-
C:\Windows\SysWOW64\341d.exeC:\Windows\SysWOW64\341d.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32 C:\Windows\system32/341e.dll,Always2⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
PID:3304
-
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE C:\Windows\system32/341e.dll,Always1⤵PID:3816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD5ae5fa7aed0088b1aac4d2574f7013640
SHA11ede7e6b0d63face3c4d939891501c07fa4d548a
SHA2568574532ba718eab1aab24532b04233418f40df96f1ce01a825311dbd904ffa25
SHA5123e242bcc244753de456840691fef2aa1d289f6c4896b8169d43f9b61d288e7d8c16dfc213fba1a230f7d39dd1b0b719d9bf17e8f876363fc69dfdb0308bfc246
-
Filesize
65KB
MD5cdc28331f910b4028b396dd5ad764267
SHA1dccdf9d861182cfc88b816f654818f58b1762ea2
SHA256e72f78c2cabc7e7afb1497a71432a8491b0f02e8f95c26c0223af170a2bd81fe
SHA5126bae9c852eafecb529435b89c7c09a1478e773d52479fa3c569e0315888de3c809e021c1a0f0c624d3765533f4bfe7cf7f35dfc00b2a7e0c112033d09ae08847
-
Filesize
58KB
MD573beda3cbab593835c73bff6415dd1ab
SHA164ba107fa0a06c9e302a33d05a6b35846d1e5336
SHA2561097e66dec23372c5cce2f4daaee6605b4365a3444ba6b18a6f4c100e029488b
SHA5127147f8a44a28d63c11cef0b517a9a52dc1a809e55b79056b4423a2a96c6bde114a6db8786fc1142ef159fe7057d993c41832eb93f7992d501eeb295209b235e3
-
Filesize
93KB
MD58fccf8520fc2e791c9813b7e5b0c6813
SHA11e70a05820b67c11501974db4fa2de2ad0e77285
SHA256931c84789eaafcfb0ba9bfdfa40c32f96cbd3c82b151df3c5120d0ca1f806bc4
SHA5128c59fd8e56626af5b4da4e1d841376b37e1a5335c9b2a90a1e05570e9a38f92c9f94fc51ee38dfffe06142e10788bb70b004410b8098cbd03a9e848bf284a5ae