Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 03:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2580bec863f1658767202e5b8d4b0cec.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2580bec863f1658767202e5b8d4b0cec.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2580bec863f1658767202e5b8d4b0cec.dll
-
Size
72KB
-
MD5
2580bec863f1658767202e5b8d4b0cec
-
SHA1
a91f4afdac742ab017024840e94f006f44264435
-
SHA256
7b11517c6a7818cb6f2d94740361c9d1e7c3cb24c3ec6c62b469e4de80743dd4
-
SHA512
91c86bc3c35edc8d0a115f40c8b429c9a29c5c32677284669ed7e48a21cb6be314b6e18b3cee946d2a2fe372e4c36329d264e2a67eb128a87fc389f5eff7d8f0
-
SSDEEP
1536:uBczgnjwsDLumVdz0dOI+MMcwoThozIWTL6a9QHZWIfSklfd0ad8uxh/Xi2e5UQM:uB3njwsDLumVdz0dOI+MMcwoThozIWTI
Score
1/10
Malware Config
Signatures
-
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7EF6C8D-D425-4D54-8D30-BE43A9CE7479}\ = "_dtSystemMonitor" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7EF6C8D-D425-4D54-8D30-BE43A9CE7479}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4D838DF1-11C4-4FEF-A450-4A3EAD305FB3}\TypeLib\ = "{15782FC8-B716-41B5-8494-FB2D57417B29}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4D838DF1-11C4-4FEF-A450-4A3EAD305FB3} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4D838DF1-11C4-4FEF-A450-4A3EAD305FB3}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\ProgID\ = "SystemMonitor.dtSystemMonitor" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{15782FC8-B716-41B5-8494-FB2D57417B29}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7EF6C8D-D425-4D54-8D30-BE43A9CE7479}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7EF6C8D-D425-4D54-8D30-BE43A9CE7479}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\VERSION regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7EF6C8D-D425-4D54-8D30-BE43A9CE7479}\ProxyStubClsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4D838DF1-11C4-4FEF-A450-4A3EAD305FB3}\ = "dtSystemMonitor" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7EF6C8D-D425-4D54-8D30-BE43A9CE7479}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\ = "SystemMonitor.dtSystemMonitor" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4D838DF1-11C4-4FEF-A450-4A3EAD305FB3}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemMonitor.dtSystemMonitor\ = "SystemMonitor.dtSystemMonitor" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4D838DF1-11C4-4FEF-A450-4A3EAD305FB3}\ProxyStubClsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{15782FC8-B716-41B5-8494-FB2D57417B29}\1.0\FLAGS\ = "2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7EF6C8D-D425-4D54-8D30-BE43A9CE7479}\TypeLib\ = "{15782FC8-B716-41B5-8494-FB2D57417B29}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4D838DF1-11C4-4FEF-A450-4A3EAD305FB3}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2580bec863f1658767202e5b8d4b0cec.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{15782FC8-B716-41B5-8494-FB2D57417B29}\1.0\ = "System Monitor" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4D838DF1-11C4-4FEF-A450-4A3EAD305FB3}\ = "__dtSystemMonitor" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2580bec863f1658767202e5b8d4b0cec.dll, 30000" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7EF6C8D-D425-4D54-8D30-BE43A9CE7479}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\Control\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4D838DF1-11C4-4FEF-A450-4A3EAD305FB3} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemMonitor.dtSystemMonitor regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7EF6C8D-D425-4D54-8D30-BE43A9CE7479}\ = "dtSystemMonitor" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\MiscStatus regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\MiscStatus\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{15782FC8-B716-41B5-8494-FB2D57417B29}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2580bec863f1658767202e5b8d4b0cec.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4D838DF1-11C4-4FEF-A450-4A3EAD305FB3}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4D838DF1-11C4-4FEF-A450-4A3EAD305FB3}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7EF6C8D-D425-4D54-8D30-BE43A9CE7479} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\Control regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{15782FC8-B716-41B5-8494-FB2D57417B29} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{15782FC8-B716-41B5-8494-FB2D57417B29}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4D838DF1-11C4-4FEF-A450-4A3EAD305FB3}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4D838DF1-11C4-4FEF-A450-4A3EAD305FB3}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4D838DF1-11C4-4FEF-A450-4A3EAD305FB3}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\ToolboxBitmap32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{15782FC8-B716-41B5-8494-FB2D57417B29}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{15782FC8-B716-41B5-8494-FB2D57417B29}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\VERSION\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{15782FC8-B716-41B5-8494-FB2D57417B29}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7EF6C8D-D425-4D54-8D30-BE43A9CE7479}\ = "_dtSystemMonitor" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4D838DF1-11C4-4FEF-A450-4A3EAD305FB3}\ = "__dtSystemMonitor" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4D838DF1-11C4-4FEF-A450-4A3EAD305FB3}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E1427E14-A2EF-435B-860C-8B51D2D5B0D6}\MiscStatus\1\ = "131473" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemMonitor.dtSystemMonitor\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{15782FC8-B716-41B5-8494-FB2D57417B29}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7EF6C8D-D425-4D54-8D30-BE43A9CE7479}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7EF6C8D-D425-4D54-8D30-BE43A9CE7479}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7EF6C8D-D425-4D54-8D30-BE43A9CE7479} regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1092 wrote to memory of 1088 1092 regsvr32.exe 1 PID 1092 wrote to memory of 1088 1092 regsvr32.exe 1 PID 1092 wrote to memory of 1088 1092 regsvr32.exe 1 PID 1092 wrote to memory of 1088 1092 regsvr32.exe 1 PID 1092 wrote to memory of 1088 1092 regsvr32.exe 1 PID 1092 wrote to memory of 1088 1092 regsvr32.exe 1 PID 1092 wrote to memory of 1088 1092 regsvr32.exe 1
Processes
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2580bec863f1658767202e5b8d4b0cec.dll1⤵
- Modifies registry class
PID:1088
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2580bec863f1658767202e5b8d4b0cec.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1092