Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
3GifShower.dll
windows7-x64
1GifShower.dll
windows10-2004-x64
1RealMediaSplitter.dll
windows7-x64
1RealMediaSplitter.dll
windows10-2004-x64
1WMFDemux.dll
windows7-x64
1WMFDemux.dll
windows10-2004-x64
1asyncflt.dll
windows7-x64
1asyncflt.dll
windows10-2004-x64
1atrc.dll
windows7-x64
1atrc.dll
windows10-2004-x64
3cook.dll
windows7-x64
3cook.dll
windows10-2004-x64
3drvc.dll
windows7-x64
1drvc.dll
windows10-2004-x64
3msvcr71.dll
windows7-x64
3msvcr71.dll
windows10-2004-x64
3pncrt.dll
windows7-x64
3pncrt.dll
windows10-2004-x64
3raac.dll
windows7-x64
3raac.dll
windows10-2004-x64
3vjocx.dll
windows7-x64
8vjocx.dll
windows10-2004-x64
8Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 13:44
Static task
static1
Behavioral task
behavioral1
Sample
GifShower.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
GifShower.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
RealMediaSplitter.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
RealMediaSplitter.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
WMFDemux.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
WMFDemux.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
asyncflt.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral8
Sample
asyncflt.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
atrc.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
atrc.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
cook.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral12
Sample
cook.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
drvc.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral14
Sample
drvc.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
msvcr71.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral16
Sample
msvcr71.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
pncrt.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral18
Sample
pncrt.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
raac.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral20
Sample
raac.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
vjocx.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral22
Sample
vjocx.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
General
-
Target
RealMediaSplitter.dll
-
Size
360KB
-
MD5
aeea88436f977d470735763e8219dcee
-
SHA1
da0046e643f05bba45f2ba4b7a972570a00fd9dc
-
SHA256
be3c4fa646686fef1af3f15c930a496a0e1c2146232d9abe4e139922ca4ce624
-
SHA512
68b62e7370f9859497f1c9c3f13ae86f5c45d699771d5c3b65d32af3c009689b373df96aaa6e5bc2ebb56fa3aac1445ccc9d94a2ad6410e6be152ed76eb089c1
-
SSDEEP
6144:e78dRsJrLRqdRIS+ZUuq4YBLxzudLZCkegz5/AuVu0yoRaGe:N6JEduSwVybzuRZxegd4Wuf
Malware Config
Signatures
-
Modifies registry class 39 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RealMediaSplitter.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7545090-002F-478A-9355-03577FA2B777} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D08A11FC-ABE2-4042-94A0-A9556E7C08AC}\CLSID = "{D08A11FC-ABE2-4042-94A0-A9556E7C08AC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF}\CLSID = "{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF}" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D7545090-002F-478A-9355-03577FA2B777}\FilterData = 020000000000400002000000000000003070693300000000000000000900000000000000000000003074793300000000e0000000f00000003174793300000000e0000000000100003274793300000000e0000000100100003374793300000000e0000000200100003474793300000000e0000000300100003574793300000000e0000000400100003674793300000000e0000000500100003774793300000000e0000000600100003874793300000000e0000000700100003170693308000000000000000100000000000000000000003074793300000000e0000000800100006175647300001000800000aa00389b7131345f3400001000800000aa00389b7132385f3800001000800000aa00389b714154524300001000800000aa00389b71434f4f4b00001000800000aa00389b71444e455400001000800000aa00389b715349505200001000800000aa00389b71ff00000000001000800000aa00389b715241414300001000800000aa00389b715241435000001000800000aa00389b710100000000001000800000aa00389b71 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D08A11FC-ABE2-4042-94A0-A9556E7C08AC}\ = "NAGA RealMedia Splitter" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF}\FriendlyName = "NAGA RealMedia Source" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF}\FilterData = 02000000000040000000000000000000 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D08A11FC-ABE2-4042-94A0-A9556E7C08AC} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7545090-002F-478A-9355-03577FA2B777}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D7545090-002F-478A-9355-03577FA2B777}\FriendlyName = "NAGA RealAudio Decoder" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D7545090-002F-478A-9355-03577FA2B777}\CLSID = "{D7545090-002F-478A-9355-03577FA2B777}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E}\0 = "0,4,,2E524D46" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D08A11FC-ABE2-4042-94A0-A9556E7C08AC}\FriendlyName = "NAGA RealMedia Splitter" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0}\CLSID = "{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7545090-002F-478A-9355-03577FA2B777}\ = "NAGA RealAudio Decoder" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D08A11FC-ABE2-4042-94A0-A9556E7C08AC} regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D08A11FC-ABE2-4042-94A0-A9556E7C08AC}\FilterData = 020000000000400002000000000000003070693300000000000000000100000000000000000000003074793300000000500000006000000031706933080000000000000000000000000000000000000083eb36e44f52ce119f530020af0ba77000000000000000000000000000000000 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF} regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0}\FilterData = 02000000000040000200000000000000307069330000000000000000040000000000000000000000307479330000000090000000a0000000317479330000000090000000b0000000327479330000000090000000c0000000337479330000000090000000d0000000317069330800000000000000010000000000000000000000307479330000000090000000e00000007669647300001000800000aa00389b715256323000001000800000aa00389b715256333000001000800000aa00389b715256343000001000800000aa00389b715256343100001000800000aa00389b7100000000000000000000000000000000 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF}\ = "NAGA RealMedia Source" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D08A11FC-ABE2-4042-94A0-A9556E7C08AC}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D08A11FC-ABE2-4042-94A0-A9556E7C08AC}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0}\ = "NAGA RealVideo Decoder" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7545090-002F-478A-9355-03577FA2B777}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0}\FriendlyName = "NAGA RealVideo Decoder" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D7545090-002F-478A-9355-03577FA2B777} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E}\Source Filter = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RealMediaSplitter.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D08A11FC-ABE2-4042-94A0-A9556E7C08AC}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RealMediaSplitter.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7545090-002F-478A-9355-03577FA2B777}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RealMediaSplitter.dll" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5104 wrote to memory of 2516 5104 regsvr32.exe 16 PID 5104 wrote to memory of 2516 5104 regsvr32.exe 16 PID 5104 wrote to memory of 2516 5104 regsvr32.exe 16