Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 14:40
Behavioral task
behavioral1
Sample
53c968317fa86fa699ece5526cc315ed.dll
Resource
win7-20231215-en
3 signatures
150 seconds
General
-
Target
53c968317fa86fa699ece5526cc315ed.dll
-
Size
369KB
-
MD5
53c968317fa86fa699ece5526cc315ed
-
SHA1
44bf2a69575385485a5075d90cc0ae6b5794b272
-
SHA256
b3913c27c447e9515eaed880bbb08c8ac892fa7d45edb5df50004bab1f1fcaf2
-
SHA512
68555629e5c6abe68102ef081d2038e94eb0ea6507d8327bea9dc550eda6c2edcd5aaa9f134ab15b64dcf4ec819f6a84e67d012ec88a6a042a0ae06ffbd31305
-
SSDEEP
6144:B+ehSQZWIDKCo3rr70coddgtnESITvkXCq9pJsLQ2L:0ehLZWqKZbrK/ZkbbWLh
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{921F7C9E-E24A-4A9A-847C-1708FBE274E7} regsvr32.exe -
Modifies registry class 11 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{921F7C9E-E24A-4A9A-847C-1708FBE274E7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53c968317fa86fa699ece5526cc315ed.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\53c968317fa86fa699ece5526cc315ed.JavaPortableMix.config regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\53c968317fa86fa699ece5526cc315ed.JavaPortableMix.config\ = "JavaPortableMix.config" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\53c968317fa86fa699ece5526cc315ed.JavaPortableMix.config\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\53c968317fa86fa699ece5526cc315ed.JavaPortableMix.config\Clsid\ = "{921F7C9E-E24A-4A9A-847C-1708FBE274E7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{921F7C9E-E24A-4A9A-847C-1708FBE274E7}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{921F7C9E-E24A-4A9A-847C-1708FBE274E7}\ProgID\ = "53c968317fa86fa699ece5526cc315ed.JavaPortableMix.config" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{921F7C9E-E24A-4A9A-847C-1708FBE274E7}\ = "JavaPortableMix.config" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{921F7C9E-E24A-4A9A-847C-1708FBE274E7}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{921F7C9E-E24A-4A9A-847C-1708FBE274E7}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{921F7C9E-E24A-4A9A-847C-1708FBE274E7} regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4396 wrote to memory of 1560 4396 regsvr32.exe 17 PID 4396 wrote to memory of 1560 4396 regsvr32.exe 17 PID 4396 wrote to memory of 1560 4396 regsvr32.exe 17
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\53c968317fa86fa699ece5526cc315ed.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\53c968317fa86fa699ece5526cc315ed.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1560
-