Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
08/01/2024, 08:11
Static task
static1
Behavioral task
behavioral1
Sample
0ef6c40c1a9b7972cd632467d993a91bcabadcc5e0dc625b9f745e3f1a565201.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0ef6c40c1a9b7972cd632467d993a91bcabadcc5e0dc625b9f745e3f1a565201.dll
Resource
win10v2004-20231215-en
General
-
Target
0ef6c40c1a9b7972cd632467d993a91bcabadcc5e0dc625b9f745e3f1a565201.dll
-
Size
219KB
-
MD5
4a79fc9416269b4f193bdf7229a46b3f
-
SHA1
6c5cb8d7f5eddfe0cb71c2aa38df9bbf602e0c63
-
SHA256
0ef6c40c1a9b7972cd632467d993a91bcabadcc5e0dc625b9f745e3f1a565201
-
SHA512
4aab11fd506261d132afcf165b706162b9dfad0e18d326136f232ede2509a1a0fdad320f66ca4cef962ca1e4d724d6cb4b3570f602c5c3d27d90d6e709fb8a5c
-
SSDEEP
6144:2C4zkyByodbSJ0l02WCL9BV+UdvrEFp7hKum:2C4tDdbSJ0CCL9BjvrEH7I
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000a000000012232-1.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 3056 regsvr32.exe -
Modifies system executable filetype association 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Glary Utilities regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Glary Utilities\ = "{B3C418F8-922B-4faf-915E-59BC14448CF7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers regsvr32.exe -
resource yara_rule behavioral1/files/0x000a000000012232-1.dat upx behavioral1/memory/3056-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/3056-5-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ContextHandler.CContextMenu\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ContextHandler.CContextMenu\CurVer\ = "ContextHandler.CContextMenu.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\ = "ICContextMenu" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A805009D-B902-439A-8E64-26EE3507A12E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Glary Utilities regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ContextHandler.CContextMenu.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\ = "ICContextMenu" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A805009D-B902-439A-8E64-26EE3507A12E}\ = "ContextHandler" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\VersionIndependentProgID\ = "ContextHandler.CContextMenu" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\TypeLib\ = "{B52C0F28-8D4C-4886-965C-0A772490064E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Glary Utilities regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ContextHandler.CContextMenu.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ContextHandler.CContextMenu\CLSID\ = "{B3C418F8-922B-4faf-915E-59BC14448CF7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\TypeLib\ = "{B52C0F28-8D4C-4886-965C-0A772490064E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\TypeLib\ = "{B52C0F28-8D4C-4886-965C-0A772490064E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ContextHandler.CContextMenu regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ContextHandler.CContextMenu\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\ = "CContextMenu Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ContextHandler.DLL\AppID = "{A805009D-B902-439A-8E64-26EE3507A12E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ContextHandler.CContextMenu.1\CLSID\ = "{B3C418F8-922B-4faf-915E-59BC14448CF7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Glary Utilities\ = "{B3C418F8-922B-4faf-915E-59BC14448CF7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ContextHandler.DLL regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0ef6c40c1a9b7972cd632467d993a91bcabadcc5e0dc625b9f745e3f1a565201.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Glary Utilities regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Glary Utilities\ = "{B3C418F8-922B-4faf-915E-59BC14448CF7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ContextHandler.CContextMenu.1\ = "CContextMenu Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD50332F-185B-4D3C-B921-E0B65E547F28}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3C418F8-922B-4faf-915E-59BC14448CF7}\ProgID\ = "ContextHandler.CContextMenu.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\ = "ContextHandler 1.0 ÀàÐÍ¿â" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B52C0F28-8D4C-4886-965C-0A772490064E}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ContextHandler.CContextMenu\ = "CContextMenu Class" regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3056 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3004 wrote to memory of 3056 3004 regsvr32.exe 28 PID 3004 wrote to memory of 3056 3004 regsvr32.exe 28 PID 3004 wrote to memory of 3056 3004 regsvr32.exe 28 PID 3004 wrote to memory of 3056 3004 regsvr32.exe 28 PID 3004 wrote to memory of 3056 3004 regsvr32.exe 28 PID 3004 wrote to memory of 3056 3004 regsvr32.exe 28 PID 3004 wrote to memory of 3056 3004 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0ef6c40c1a9b7972cd632467d993a91bcabadcc5e0dc625b9f745e3f1a565201.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0ef6c40c1a9b7972cd632467d993a91bcabadcc5e0dc625b9f745e3f1a565201.dll2⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab