Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
24/04/2024, 18:14
Static task
static1
Behavioral task
behavioral1
Sample
85b26c249b4d224200d2426f87f91f71b361cbff1eb7dd31592b0ad583656ed2.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
85b26c249b4d224200d2426f87f91f71b361cbff1eb7dd31592b0ad583656ed2.dll
Resource
win10v2004-20240226-en
General
-
Target
85b26c249b4d224200d2426f87f91f71b361cbff1eb7dd31592b0ad583656ed2.dll
-
Size
315KB
-
MD5
3c3dc2034f0a803fddabd9f46b7d2f90
-
SHA1
25a67b7881d5c530f7beec5b19b186f86c00986d
-
SHA256
85b26c249b4d224200d2426f87f91f71b361cbff1eb7dd31592b0ad583656ed2
-
SHA512
b9208a483487a48313c8ab46a6b7abf66c2c3c21d3abc7e03c2b5cd199d36cbd6d3e946301369d46218a4facab78e5aee74cfac60f11a5ab7bb19596538e16d6
-
SSDEEP
6144:/hux2sLQKgfrxhtAMmuv8mbuIvACpbNL9qdGzdD0Cu23kY7XIneZkwAWqWWRc5t5:/5xhtAMmuv8mbuqACRNLiGxLuMx7XInW
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED94CF49-1A2A-48A3-9A05-EB5D39AFAA6B}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\85b26c249b4d224200d2426f87f91f71b361cbff1eb7dd31592b0ad583656ed2.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD62E99B-27E9-4809-AE95-6A288341B55A}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD62E99B-27E9-4809-AE95-6A288341B55A}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B1BBBB6-A94A-4A95-ABFD-6039B7F916E1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\85b26c249b4d224200d2426f87f91f71b361cbff1eb7dd31592b0ad583656ed2.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B1BBBB6-A94A-4A95-ABFD-6039B7F916E1}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD62E99B-27E9-4809-AE95-6A288341B55A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\85b26c249b4d224200d2426f87f91f71b361cbff1eb7dd31592b0ad583656ed2.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED94CF49-1A2A-48A3-9A05-EB5D39AFAA6B}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED94CF49-1A2A-48A3-9A05-EB5D39AFAA6B}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B1BBBB6-A94A-4A95-ABFD-6039B7F916E1}\InprocServer32 regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B1BBBB6-A94A-4A95-ABFD-6039B7F916E1}\ = "AsApp Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD62E99B-27E9-4809-AE95-6A288341B55A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7F84AF74-4D6E-4EF3-A5E5-AE33C46B75B2}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8FB8B48C-3613-48BC-A415-D73B6689A7C0}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8FB8B48C-3613-48BC-A415-D73B6689A7C0}\TypeLib\ = "{7F84AF74-4D6E-4EF3-A5E5-AE33C46B75B2}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ED94CF49-1A2A-48A3-9A05-EB5D39AFAA6B}\ProxyStubClsid32\ = "{ED94CF49-1A2A-48A3-9A05-EB5D39AFAA6B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Atasuicom.AsApp\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C536655-7F6D-4137-A52B-F0A5B7D258A7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Atasuicom.AsApp\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B1BBBB6-A94A-4A95-ABFD-6039B7F916E1}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD62E99B-27E9-4809-AE95-6A288341B55A}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD62E99B-27E9-4809-AE95-6A288341B55A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\85b26c249b4d224200d2426f87f91f71b361cbff1eb7dd31592b0ad583656ed2.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7F84AF74-4D6E-4EF3-A5E5-AE33C46B75B2} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED94CF49-1A2A-48A3-9A05-EB5D39AFAA6B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ED94CF49-1A2A-48A3-9A05-EB5D39AFAA6B}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8FB8B48C-3613-48BC-A415-D73B6689A7C0}\ = "_IAsUIComEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Atasuicom.AsAnnot.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Atasuicom.AsAnnot\CurVer\ = "Atasuicom.AsAnnot.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD62E99B-27E9-4809-AE95-6A288341B55A}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8FB8B48C-3613-48BC-A415-D73B6689A7C0}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8FB8B48C-3613-48BC-A415-D73B6689A7C0}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C536655-7F6D-4137-A52B-F0A5B7D258A7}\NumMethods\ = "7" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD7672F7-C0B4-4090-A2F8-234C0062F42C}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Atasuicom.AsApp.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7F84AF74-4D6E-4EF3-A5E5-AE33C46B75B2}\1.0\ = "atasuicom 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FB8B48C-3613-48BC-A415-D73B6689A7C0}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ED94CF49-1A2A-48A3-9A05-EB5D39AFAA6B}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C536655-7F6D-4137-A52B-F0A5B7D258A7}\ = "IASLaunchApp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD7672F7-C0B4-4090-A2F8-234C0062F42C}\NumMethods\ = "5" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Atasuicom.AsApp regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Atasuicom.AsAnnot.1\CLSID\ = "{BD62E99B-27E9-4809-AE95-6A288341B55A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C536655-7F6D-4137-A52B-F0A5B7D258A7}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C536655-7F6D-4137-A52B-F0A5B7D258A7}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED94CF49-1A2A-48A3-9A05-EB5D39AFAA6B}\ = "PSFactoryBuffer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B1BBBB6-A94A-4A95-ABFD-6039B7F916E1} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD62E99B-27E9-4809-AE95-6A288341B55A}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD62E99B-27E9-4809-AE95-6A288341B55A}\TypeLib\ = "{94C16BF5-9DDF-4054-983B-3A224E0F14E2}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7F84AF74-4D6E-4EF3-A5E5-AE33C46B75B2}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FB8B48C-3613-48BC-A415-D73B6689A7C0}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Atasuicom.AsApp\CurVer\ = "Atasuicom.AsApp.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B1BBBB6-A94A-4A95-ABFD-6039B7F916E1}\AppID = "{8B1BBBB6-A94A-4A95-ABFD-6039B7F916E1}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B1BBBB6-A94A-4A95-ABFD-6039B7F916E1}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7F84AF74-4D6E-4EF3-A5E5-AE33C46B75B2}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\85b26c249b4d224200d2426f87f91f71b361cbff1eb7dd31592b0ad583656ed2.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FB8B48C-3613-48BC-A415-D73B6689A7C0}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Atasuicom.AsApp\ = "AsApp Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B1BBBB6-A94A-4A95-ABFD-6039B7F916E1}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Atasuicom.AsAnnot\CLSID\ = "{BD62E99B-27E9-4809-AE95-6A288341B55A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD62E99B-27E9-4809-AE95-6A288341B55A}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FB8B48C-3613-48BC-A415-D73B6689A7C0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FB8B48C-3613-48BC-A415-D73B6689A7C0}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED94CF49-1A2A-48A3-9A05-EB5D39AFAA6B}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Atasuicom.AsApp.1\CLSID\ = "{8B1BBBB6-A94A-4A95-ABFD-6039B7F916E1}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD62E99B-27E9-4809-AE95-6A288341B55A}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ED94CF49-1A2A-48A3-9A05-EB5D39AFAA6B}\ = "IASAnnotation" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B1BBBB6-A94A-4A95-ABFD-6039B7F916E1}\TypeLib\ = "{7F84AF74-4D6E-4EF3-A5E5-AE33C46B75B2}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Atasuicom.AsAnnot\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7F84AF74-4D6E-4EF3-A5E5-AE33C46B75B2}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7F84AF74-4D6E-4EF3-A5E5-AE33C46B75B2}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD7672F7-C0B4-4090-A2F8-234C0062F42C}\ProxyStubClsid32\ = "{ED94CF49-1A2A-48A3-9A05-EB5D39AFAA6B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B1BBBB6-A94A-4A95-ABFD-6039B7F916E1}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Atasuicom.AsApp\CLSID\ = "{8B1BBBB6-A94A-4A95-ABFD-6039B7F916E1}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD62E99B-27E9-4809-AE95-6A288341B55A}\VersionIndependentProgID\ = "Atasuicom.AsAnnot" regsvr32.exe