Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 07:17
Static task
static1
Behavioral task
behavioral1
Sample
29c30218aafad468fa6d6124fd141fe35210abd203049447d4da8dd2e9c3ae08.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
29c30218aafad468fa6d6124fd141fe35210abd203049447d4da8dd2e9c3ae08.dll
Resource
win10v2004-20240226-en
General
-
Target
29c30218aafad468fa6d6124fd141fe35210abd203049447d4da8dd2e9c3ae08.dll
-
Size
3.2MB
-
MD5
d0c88cf7492780600d7fc942ffda4598
-
SHA1
ea861654197ffcfeb7485cc2ef6603f801bdeb2f
-
SHA256
29c30218aafad468fa6d6124fd141fe35210abd203049447d4da8dd2e9c3ae08
-
SHA512
074dc2b563af88624e4e020398fc6b86d6623fbdc6c231d0e077b38dc53775082462850c26917de9609126bcf5207820f9513a844919ace090e97927b0ba93cf
-
SSDEEP
98304:GFxzhxTHuQcE+6zYfOeBxUkWC7Y3x1gpmIhhQ5:IzhB5aOGUko20II5
Malware Config
Signatures
-
Modifies registry class 37 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE9BC321-0264-EDAC-7FEF-AF2B96CA7F33}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DEC7D9D-8F67-4DC3-5144-8C81C7228F9A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\da.dasoft\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3574D7D1-A8FF-0F00-905E-EA4277A3BDA9}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE9BC321-0264-EDAC-7FEF-AF2B96CA7F33}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DEC7D9D-8F67-4DC3-5144-8C81C7228F9A}\ = "Idasoft" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1DEC7D9D-8F67-4DC3-5144-8C81C7228F9A}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3574D7D1-A8FF-0F00-905E-EA4277A3BDA9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\29c30218aafad468fa6d6124fd141fe35210abd203049447d4da8dd2e9c3ae08.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE9BC321-0264-EDAC-7FEF-AF2B96CA7F33} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE9BC321-0264-EDAC-7FEF-AF2B96CA7F33}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE9BC321-0264-EDAC-7FEF-AF2B96CA7F33}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\29c30218aafad468fa6d6124fd141fe35210abd203049447d4da8dd2e9c3ae08.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DEC7D9D-8F67-4DC3-5144-8C81C7228F9A}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\da.dasoft regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3574D7D1-A8FF-0F00-905E-EA4277A3BDA9}\ProgID\ = "da.dasoft" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3574D7D1-A8FF-0F00-905E-EA4277A3BDA9} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE9BC321-0264-EDAC-7FEF-AF2B96CA7F33}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE9BC321-0264-EDAC-7FEF-AF2B96CA7F33}\1.0\HELPDIR\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DEC7D9D-8F67-4DC3-5144-8C81C7228F9A}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DEC7D9D-8F67-4DC3-5144-8C81C7228F9A}\TypeLib\ = "{FE9BC321-0264-EDAC-7FEF-AF2B96CA7F33}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\da.dasoft\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\da.dasoft\CurVer\ = "da.dasoft" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1DEC7D9D-8F67-4DC3-5144-8C81C7228F9A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE9BC321-0264-EDAC-7FEF-AF2B96CA7F33}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE9BC321-0264-EDAC-7FEF-AF2B96CA7F33}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DEC7D9D-8F67-4DC3-5144-8C81C7228F9A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DEC7D9D-8F67-4DC3-5144-8C81C7228F9A}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1DEC7D9D-8F67-4DC3-5144-8C81C7228F9A}\TypeLib\ = "{FE9BC321-0264-EDAC-7FEF-AF2B96CA7F33}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\da.dasoft\ = "da.dasoft" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3574D7D1-A8FF-0F00-905E-EA4277A3BDA9}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE9BC321-0264-EDAC-7FEF-AF2B96CA7F33}\1.0\ = "da" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1DEC7D9D-8F67-4DC3-5144-8C81C7228F9A}\ = "Idasoft" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3574D7D1-A8FF-0F00-905E-EA4277A3BDA9}\ = "da.dasoft" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3574D7D1-A8FF-0F00-905E-EA4277A3BDA9}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1DEC7D9D-8F67-4DC3-5144-8C81C7228F9A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1DEC7D9D-8F67-4DC3-5144-8C81C7228F9A}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\da.dasoft\CLSID\ = "{3574D7D1-A8FF-0F00-905E-EA4277A3BDA9}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1DEC7D9D-8F67-4DC3-5144-8C81C7228F9A}\ProxyStubClsid32 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4188 wrote to memory of 1236 4188 regsvr32.exe 91 PID 4188 wrote to memory of 1236 4188 regsvr32.exe 91 PID 4188 wrote to memory of 1236 4188 regsvr32.exe 91
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\29c30218aafad468fa6d6124fd141fe35210abd203049447d4da8dd2e9c3ae08.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\29c30218aafad468fa6d6124fd141fe35210abd203049447d4da8dd2e9c3ae08.dll2⤵
- Modifies registry class
PID:1236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:2876