Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11/01/2024, 14:40
Behavioral task
behavioral1
Sample
53c968317fa86fa699ece5526cc315ed.dll
Resource
win7-20231215-en
3 signatures
150 seconds
General
-
Target
53c968317fa86fa699ece5526cc315ed.dll
-
Size
369KB
-
MD5
53c968317fa86fa699ece5526cc315ed
-
SHA1
44bf2a69575385485a5075d90cc0ae6b5794b272
-
SHA256
b3913c27c447e9515eaed880bbb08c8ac892fa7d45edb5df50004bab1f1fcaf2
-
SHA512
68555629e5c6abe68102ef081d2038e94eb0ea6507d8327bea9dc550eda6c2edcd5aaa9f134ab15b64dcf4ec819f6a84e67d012ec88a6a042a0ae06ffbd31305
-
SSDEEP
6144:B+ehSQZWIDKCo3rr70coddgtnESITvkXCq9pJsLQ2L:0ehLZWqKZbrK/ZkbbWLh
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{921F7C9E-E24A-4A9A-847C-1708FBE274E7} regsvr32.exe -
Modifies registry class 11 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{921F7C9E-E24A-4A9A-847C-1708FBE274E7}\ = "JavaPortableMix.config" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\53c968317fa86fa699ece5526cc315ed.JavaPortableMix.config\ = "JavaPortableMix.config" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\53c968317fa86fa699ece5526cc315ed.JavaPortableMix.config\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\53c968317fa86fa699ece5526cc315ed.JavaPortableMix.config\Clsid\ = "{921F7C9E-E24A-4A9A-847C-1708FBE274E7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{921F7C9E-E24A-4A9A-847C-1708FBE274E7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{921F7C9E-E24A-4A9A-847C-1708FBE274E7}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{921F7C9E-E24A-4A9A-847C-1708FBE274E7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53c968317fa86fa699ece5526cc315ed.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{921F7C9E-E24A-4A9A-847C-1708FBE274E7}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\53c968317fa86fa699ece5526cc315ed.JavaPortableMix.config regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{921F7C9E-E24A-4A9A-847C-1708FBE274E7}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{921F7C9E-E24A-4A9A-847C-1708FBE274E7}\ProgID\ = "53c968317fa86fa699ece5526cc315ed.JavaPortableMix.config" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1656 wrote to memory of 1832 1656 regsvr32.exe 14 PID 1656 wrote to memory of 1832 1656 regsvr32.exe 14 PID 1656 wrote to memory of 1832 1656 regsvr32.exe 14 PID 1656 wrote to memory of 1832 1656 regsvr32.exe 14 PID 1656 wrote to memory of 1832 1656 regsvr32.exe 14 PID 1656 wrote to memory of 1832 1656 regsvr32.exe 14 PID 1656 wrote to memory of 1832 1656 regsvr32.exe 14
Processes
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\53c968317fa86fa699ece5526cc315ed.dll1⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1832
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\53c968317fa86fa699ece5526cc315ed.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1656