Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 20:41
Behavioral task
behavioral1
Sample
1c08339293cf52666c8b32d8a196f7ab.dll
Resource
win7-20231129-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
1c08339293cf52666c8b32d8a196f7ab.dll
Resource
win10v2004-20231215-en
6 signatures
150 seconds
General
-
Target
1c08339293cf52666c8b32d8a196f7ab.dll
-
Size
235KB
-
MD5
1c08339293cf52666c8b32d8a196f7ab
-
SHA1
cd488228cf269f6673d740866cfee85e855f9e21
-
SHA256
2efb6e749e4106fcd1c7b2a03205e34b2e2a4ebb7a2022eb01f185b3ff0b1244
-
SHA512
8ae404a86dd1b923e92ed264f10b4a7476432f65b4c7b6dfa2a281c55c8316c01283e07ad8be7114222174218e6fcbac7a40c233846c60d632b531bac6fb433a
-
SSDEEP
3072:KT/PM6+iJSu4HpEfWF0sYNPgDPutatPr7LRQtTmgw+kDJeR032NHYYBcMIwt45Zy:8H+iJSb2qLosD532NH2MIw+nQvt6a2
Score
8/10
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\tmsscvl\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1c08339293cf52666c8b32d8a196f7ab.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\tmsscvl\Parameters\ServiceDll = "c:\\users\\admin\\appdata\\local\\temp\\1c08339293cf52666c8b32d8a196f7ab.dll" svchost.exe -
Sets service image path in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\tmsscvl\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k tmsscvl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\tmsscvl\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k tmsscvl" svchost.exe -
resource yara_rule behavioral2/memory/1068-0-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral2/memory/4420-2-0x0000000000400000-0x00000000004A9000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 svchost.exe -
Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4808 wrote to memory of 1068 4808 regsvr32.exe 88 PID 4808 wrote to memory of 1068 4808 regsvr32.exe 88 PID 4808 wrote to memory of 1068 4808 regsvr32.exe 88
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1c08339293cf52666c8b32d8a196f7ab.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1c08339293cf52666c8b32d8a196f7ab.dll2⤵
- Sets DLL path for service in the registry
- Sets service image path in registry
PID:1068
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k tmsscvl -s tmsscvl1⤵
- Sets DLL path for service in the registry
- Sets service image path in registry
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4420