Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15/04/2024, 20:11

General

  • Target

    Cloud-Web_2_86.dll

  • Size

    123KB

  • MD5

    f5e11bef483ed3b0c2436099a61b090b

  • SHA1

    fbf8fb0a380d69ab83365a0f9dfb9d6aa89ca0c8

  • SHA256

    02ff072273315997902c1aaa97d111d99e75bc4624e9b2a3f801d469d9a6bf3f

  • SHA512

    9d7ebcc4e7a6cc3049b90a30d9ab1c7dc23307c4050b79b4de7cb407130424a49222e9ceefd09016f74e7306b87f164c6d91b8adb9367b01eefe91005b24f5f9

  • SSDEEP

    3072:hNG0ZeC/azzmWxd/mZQA31L46eqtJGrCclno:PtzyKYJmmA7eRr4

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies registry class 48 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Cloud-Web_2_86.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\Cloud-Web_2_86.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      PID:2264

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2264-0-0x0000000001F60000-0x0000000001FED000-memory.dmp

    Filesize

    564KB