Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2024, 14:40

General

  • Target

    53c968317fa86fa699ece5526cc315ed.dll

  • Size

    369KB

  • MD5

    53c968317fa86fa699ece5526cc315ed

  • SHA1

    44bf2a69575385485a5075d90cc0ae6b5794b272

  • SHA256

    b3913c27c447e9515eaed880bbb08c8ac892fa7d45edb5df50004bab1f1fcaf2

  • SHA512

    68555629e5c6abe68102ef081d2038e94eb0ea6507d8327bea9dc550eda6c2edcd5aaa9f134ab15b64dcf4ec819f6a84e67d012ec88a6a042a0ae06ffbd31305

  • SSDEEP

    6144:B+ehSQZWIDKCo3rr70coddgtnESITvkXCq9pJsLQ2L:0ehLZWqKZbrK/ZkbbWLh

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies registry class 11 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\53c968317fa86fa699ece5526cc315ed.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4396
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\53c968317fa86fa699ece5526cc315ed.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      PID:1560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1560-0-0x000000003BAF0000-0x000000003BBFD000-memory.dmp

    Filesize

    1.1MB

  • memory/1560-1-0x0000000001120000-0x0000000001121000-memory.dmp

    Filesize

    4KB