Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 19:00
Static task
static1
Behavioral task
behavioral1
Sample
16cb7cb8fb9555f122ea00dc3ecb5371e580c504532be71a41c63891ef3bf491.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
16cb7cb8fb9555f122ea00dc3ecb5371e580c504532be71a41c63891ef3bf491.dll
Resource
win10v2004-20240426-en
General
-
Target
16cb7cb8fb9555f122ea00dc3ecb5371e580c504532be71a41c63891ef3bf491.dll
-
Size
1.1MB
-
MD5
d61de973554e5ae4b6690275a6b7eb61
-
SHA1
c3cb298671af2fca04e17326cb3a624b29baae21
-
SHA256
16cb7cb8fb9555f122ea00dc3ecb5371e580c504532be71a41c63891ef3bf491
-
SHA512
31944b6bf3c81f66e47f88079b672e94c920406c9b40ed3632758fc1b7eae1e95738c9b9495a25b197463ca64615a80d808ddb9f00be0f623081db6ab0f9fd95
-
SSDEEP
24576:0LUoVJwLfpm9GbPYl5IguaHbX6HMfPoc7Qt/lCSYgfvRaxOpVo:Xfppk5zf7QtdrRa4Vo
Malware Config
Signatures
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{0ACC6E46-4744-4D16-8901-F8FB92509BDD}\DllSurrogate regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\AppID = "{0ACC6E46-4744-4D16-8901-F8FB92509BDD}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\16cb7cb8fb9555f122ea00dc3ecb5371e580c504532be71a41c63891ef3bf491.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{0ACC6E46-4744-4D16-8901-F8FB92509BDD} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{0ACC6E46-4744-4D16-8901-F8FB92509BDD}\ regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 116 wrote to memory of 2020 116 regsvr32.exe 82 PID 116 wrote to memory of 2020 116 regsvr32.exe 82 PID 116 wrote to memory of 2020 116 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\16cb7cb8fb9555f122ea00dc3ecb5371e580c504532be71a41c63891ef3bf491.dll1⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\16cb7cb8fb9555f122ea00dc3ecb5371e580c504532be71a41c63891ef3bf491.dll2⤵
- Modifies registry class
PID:2020
-