Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 20:41
Behavioral task
behavioral1
Sample
1c08339293cf52666c8b32d8a196f7ab.dll
Resource
win7-20231129-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
1c08339293cf52666c8b32d8a196f7ab.dll
Resource
win10v2004-20231215-en
6 signatures
150 seconds
General
-
Target
1c08339293cf52666c8b32d8a196f7ab.dll
-
Size
235KB
-
MD5
1c08339293cf52666c8b32d8a196f7ab
-
SHA1
cd488228cf269f6673d740866cfee85e855f9e21
-
SHA256
2efb6e749e4106fcd1c7b2a03205e34b2e2a4ebb7a2022eb01f185b3ff0b1244
-
SHA512
8ae404a86dd1b923e92ed264f10b4a7476432f65b4c7b6dfa2a281c55c8316c01283e07ad8be7114222174218e6fcbac7a40c233846c60d632b531bac6fb433a
-
SSDEEP
3072:KT/PM6+iJSu4HpEfWF0sYNPgDPutatPr7LRQtTmgw+kDJeR032NHYYBcMIwt45Zy:8H+iJSb2qLosD532NH2MIw+nQvt6a2
Score
8/10
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\tmsscvl\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1c08339293cf52666c8b32d8a196f7ab.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\tmsscvl\Parameters\ServiceDll = "c:\\users\\admin\\appdata\\local\\temp\\1c08339293cf52666c8b32d8a196f7ab.dll" svchost.exe -
Sets service image path in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\tmsscvl\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k tmsscvl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\tmsscvl\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k tmsscvl" svchost.exe -
resource yara_rule behavioral1/memory/2172-1-0x00000000004A0000-0x0000000000549000-memory.dmp upx behavioral1/memory/1728-0-0x0000000000370000-0x0000000000419000-memory.dmp upx behavioral1/memory/2172-2-0x00000000004A0000-0x0000000000549000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat svchost.exe -
Modifies data under HKEY_USERS 28 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-21-de-80-3d-af\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-21-de-80-3d-af\WpadDecisionTime = d03379fa6a3cda01 svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F52F0D-F0A8-49E4-B7D6-C6A2E63CF306}\WpadDecisionTime = b028e2f86a3cda01 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F52F0D-F0A8-49E4-B7D6-C6A2E63CF306}\WpadDecisionTime = d03379fa6a3cda01 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-21-de-80-3d-af svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0038000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F52F0D-F0A8-49E4-B7D6-C6A2E63CF306}\WpadNetworkName = "Network 3" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F52F0D-F0A8-49E4-B7D6-C6A2E63CF306} svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-21-de-80-3d-af\WpadDecision = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-21-de-80-3d-af\WpadDetectedUrl svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0038000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F52F0D-F0A8-49E4-B7D6-C6A2E63CF306}\WpadDecisionReason = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F52F0D-F0A8-49E4-B7D6-C6A2E63CF306}\a6-21-de-80-3d-af svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a6-21-de-80-3d-af\WpadDecisionTime = b028e2f86a3cda01 svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F52F0D-F0A8-49E4-B7D6-C6A2E63CF306}\WpadDecision = "0" svchost.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2544 wrote to memory of 1728 2544 regsvr32.exe 16 PID 2544 wrote to memory of 1728 2544 regsvr32.exe 16 PID 2544 wrote to memory of 1728 2544 regsvr32.exe 16 PID 2544 wrote to memory of 1728 2544 regsvr32.exe 16 PID 2544 wrote to memory of 1728 2544 regsvr32.exe 16 PID 2544 wrote to memory of 1728 2544 regsvr32.exe 16 PID 2544 wrote to memory of 1728 2544 regsvr32.exe 16
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1c08339293cf52666c8b32d8a196f7ab.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1c08339293cf52666c8b32d8a196f7ab.dll2⤵
- Sets DLL path for service in the registry
- Sets service image path in registry
PID:1728
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k tmsscvl1⤵
- Sets DLL path for service in the registry
- Sets service image path in registry
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2172