Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2024, 08:04
Static task
static1
Behavioral task
behavioral1
Sample
5ab8b33e846e589eb2aaa5a029b833fd.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5ab8b33e846e589eb2aaa5a029b833fd.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
5ab8b33e846e589eb2aaa5a029b833fd.dll
-
Size
245KB
-
MD5
5ab8b33e846e589eb2aaa5a029b833fd
-
SHA1
adb10238788df23df44174a7ef07f4f61c99c4b0
-
SHA256
be64c3af05f581ea4c3285423c1306353e2e542d1937126cc0d9adbca2c15f30
-
SHA512
1c676f8139655f52b31e3b1371696283fa9857fa9cc88ce6de522c40ceafb7b3691c07f12008cda13e470f9294bce69e28780187f32e922914bf89948cb5bc04
-
SSDEEP
3072:5akdRFohBfn6Szatra5xigTUACKKdraRJtY+O+OyoY4sLZFI+LvFYvxU3k:5aq6h16xtryTBCZBaRHYeohYF1LvavaU
Score
7/10
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5CF14A2-B3CA-49DC-8E3E-0BB233B26D09}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5CF14A2-B3CA-49DC-8E3E-0BB233B26D09}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5CF14A2-B3CA-49DC-8E3E-0BB233B26D09}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5ab8b33e846e589eb2aaa5a029b833fd.dll" regsvr32.exe -
Modifies registry class 33 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\FileAssociationHelper regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4C7D00B-96C6-4C4B-AFA4-91DB66FF7AC5}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4C7D00B-96C6-4C4B-AFA4-91DB66FF7AC5}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5CF14A2-B3CA-49DC-8E3E-0BB233B26D09}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4C7D00B-96C6-4C4B-AFA4-91DB66FF7AC5}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB5F401F-E166-43B0-A845-ACB9B0B238BD}\ = "IContextMenuExt" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB5F401F-E166-43B0-A845-ACB9B0B238BD}\TypeLib\ = "{D4C7D00B-96C6-4C4B-AFA4-91DB66FF7AC5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4C7D00B-96C6-4C4B-AFA4-91DB66FF7AC5} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4C7D00B-96C6-4C4B-AFA4-91DB66FF7AC5}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5CF14A2-B3CA-49DC-8E3E-0BB233B26D09}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5CF14A2-B3CA-49DC-8E3E-0BB233B26D09}\TypeLib\ = "{D4C7D00B-96C6-4C4B-AFA4-91DB66FF7AC5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4C7D00B-96C6-4C4B-AFA4-91DB66FF7AC5}\1.0\0\win64 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4C7D00B-96C6-4C4B-AFA4-91DB66FF7AC5}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5ab8b33e846e589eb2aaa5a029b833fd.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB5F401F-E166-43B0-A845-ACB9B0B238BD}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB5F401F-E166-43B0-A845-ACB9B0B238BD}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB5F401F-E166-43B0-A845-ACB9B0B238BD}\TypeLib\ = "{D4C7D00B-96C6-4C4B-AFA4-91DB66FF7AC5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5CF14A2-B3CA-49DC-8E3E-0BB233B26D09}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5ab8b33e846e589eb2aaa5a029b833fd.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\FileAssociationHelper\ = "{D5CF14A2-B3CA-49DC-8E3E-0BB233B26D09}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4C7D00B-96C6-4C4B-AFA4-91DB66FF7AC5}\1.0\ = "FAHDll 1.0 Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB5F401F-E166-43B0-A845-ACB9B0B238BD}\ = "IContextMenuExt" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB5F401F-E166-43B0-A845-ACB9B0B238BD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB5F401F-E166-43B0-A845-ACB9B0B238BD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5CF14A2-B3CA-49DC-8E3E-0BB233B26D09} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5CF14A2-B3CA-49DC-8E3E-0BB233B26D09}\ = "ContextMenuExt" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4C7D00B-96C6-4C4B-AFA4-91DB66FF7AC5}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB5F401F-E166-43B0-A845-ACB9B0B238BD}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB5F401F-E166-43B0-A845-ACB9B0B238BD} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB5F401F-E166-43B0-A845-ACB9B0B238BD}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB5F401F-E166-43B0-A845-ACB9B0B238BD}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5CF14A2-B3CA-49DC-8E3E-0BB233B26D09}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D4C7D00B-96C6-4C4B-AFA4-91DB66FF7AC5}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB5F401F-E166-43B0-A845-ACB9B0B238BD} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB5F401F-E166-43B0-A845-ACB9B0B238BD}\TypeLib\Version = "1.0" regsvr32.exe