Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10FN-TOOLZ-m...AN.bat
windows10-2004-x64
10Tournament...ew.exe
windows10-2004-x64
6Tournament...al.dll
windows10-2004-x64
1Tournament...UI.dll
windows10-2004-x64
1Tournament...cl.exe
windows10-2004-x64
1Tournament...uz.exe
windows10-2004-x64
9Tournament...dc.exe
windows10-2004-x64
1Tournament...ft.exe
windows10-2004-x64
1Tournament...64.exe
windows10-2004-x64
1Tournament...32.exe
windows10-2004-x64
1Tournament...64.exe
windows10-2004-x64
4Tournament...fg.exe
windows10-2004-x64
3Tournament...sg.exe
windows10-2004-x64
3Tournament...sr.exe
windows10-2004-x64
10Tournament...wg.exe
windows10-2004-x64
1Tournament...sm.dll
windows10-2004-x64
1Tournament...xy.dll
windows10-2004-x64
7Tournament...ry.dll
windows10-2004-x64
1Tournament...ll.dll
windows10-2004-x64
1Tournament...pi.dll
windows10-2004-x64
1Tournament...32.dll
windows10-2004-x64
1Tournament...da.dll
windows10-2004-x64
1Tournament...ve.dll
windows10-2004-x64
1Tournament...70.dll
windows10-2004-x64
1Tournament...rl.exe
windows10-2004-x64
3Tournament...64.exe
windows10-2004-x64
3Tournament...cs.exe
windows10-2004-x64
8Tournament...64.exe
windows10-2004-x64
10Tournament...tm.exe
windows10-2004-x64
3Tournament...mc.exe
windows10-2004-x64
1FN-TOOLZ-m...er.exe
windows10-2004-x64
9FN-TOOLZ-m...er.bat
windows10-2004-x64
1Analysis
-
max time kernel
243s -
max time network
259s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/06/2024, 20:50
Behavioral task
behavioral1
Sample
FN-TOOLZ-main/FNCLEAN.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
Tournament_Fixer/AdditionalRuntimes/DevManView.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
Tournament_Fixer/AdditionalRuntimes/MCCSPal.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
Tournament_Fixer/AdditionalRuntimes/MaintenanceUI.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
Tournament_Fixer/AdditionalRuntimes/ccl.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral6
Sample
Tournament_Fixer/AdditionalRuntimes/cpuz.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Tournament_Fixer/AdditionalRuntimes/ddc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
Tournament_Fixer/AdditionalRuntimes/hssft.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
Tournament_Fixer/AdditionalRuntimes/hwbd64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
Tournament_Fixer/AdditionalRuntimes/hwinfo32.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
Tournament_Fixer/AdditionalRuntimes/hwinfo64.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral12
Sample
Tournament_Fixer/AdditionalRuntimes/jfg.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Tournament_Fixer/AdditionalRuntimes/jsg.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral14
Sample
Tournament_Fixer/AdditionalRuntimes/jsr.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
Tournament_Fixer/AdditionalRuntimes/kwg.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral16
Sample
Tournament_Fixer/AdditionalRuntimes/lsm.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Tournament_Fixer/AdditionalRuntimes/lsmproxy.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
Tournament_Fixer/AdditionalRuntimes/lstelemetry.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
Tournament_Fixer/AdditionalRuntimes/luainstall.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
Tournament_Fixer/AdditionalRuntimes/luiapi.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Tournament_Fixer/AdditionalRuntimes/lz32.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral22
Sample
Tournament_Fixer/AdditionalRuntimes/mcicda.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
Tournament_Fixer/AdditionalRuntimes/mciwave.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral24
Sample
Tournament_Fixer/AdditionalRuntimes/mfc70.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
Tournament_Fixer/AdditionalRuntimes/nvrl.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral26
Sample
Tournament_Fixer/AdditionalRuntimes/nvrl64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Tournament_Fixer/AdditionalRuntimes/tcs.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral28
Sample
Tournament_Fixer/AdditionalRuntimes/tcs64.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
Tournament_Fixer/AdditionalRuntimes/tm.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral30
Sample
Tournament_Fixer/AdditionalRuntimes/wmc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
FN-TOOLZ-main/applecleaner.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral32
Sample
FN-TOOLZ-main/serial_checker.bat
Resource
win10v2004-20240508-en
General
-
Target
Tournament_Fixer/AdditionalRuntimes/lsmproxy.dll
-
Size
46KB
-
MD5
8a1ef06ef5c60a50c634de99b4465321
-
SHA1
d067132a95b17d5aa4cffc3bffc4eabc5a3c4da0
-
SHA256
edb9d19b4f79c1d83850e35e6254beab878aae0bb1abd51879ef575d6f21b2a9
-
SHA512
4b3cba2b9c6cddc10fdd9e0071b41a52c8be85959283ef4317ad0959dbeebf3664d0a9c7b21056d3d961f6ef55c85ecd27337614c86dbf6c17806323080a362b
-
SSDEEP
768:l4Whda3PalNNlhEwzgJ53KR40CVAyXXmpA2mENRGg3fhXfuVSQi6X/HUA+gjf:icvlawzgJ53KR40CVAyXXmrmENRGg3fa
Malware Config
Signatures
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EB34008-F34A-4D88-BD3A-0D597908C5A4}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2D3E131-C587-49B4-8BAE-F0EE269EEB31} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{043C0DB0-345F-4715-BD44-BB53FE1CC603}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6344A5B7-EF1C-47BA-98B7-28C664427793} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75A446C5-40B7-41D3-8D53-292652C04121} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CFF90F7-F175-4277-BF0A-408906B22B75} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{98167041-8333-4947-9D72-D65D5A751C11} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A46A6E50-0994-4639-AADA-296488B58AC1} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1B7DE7A-4E77-43DB-AE78-96FC182FED4A}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6E796D86-376C-46FE-8381-43982EDD00FE} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6E796D86-376C-46FE-8381-43982EDD00FE}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CFC351CD-3795-458E-B590-34046794AB2F}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9EB34008-F34A-4D88-BD3A-0D597908C5A4}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A8105B4F-7D5A-402B-AAC0-FD85DAECF94C}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ABDE9756-B57E-4BD3-A393-C70F9ED04277} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ABDE9756-B57E-4BD3-A393-C70F9ED04277}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1A8A5D71-D95B-4DCD-915E-F9F6D31879AD}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6344A5B7-EF1C-47BA-98B7-28C664427793}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{517F87FE-597A-4672-8555-6DAF1C8C788D}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{c2d3e131-c587-49b4-8bae-f0ee269eeb31}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4D10B48B-C531-4731-9BDE-B03C28E9C61C}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75A446C5-40B7-41D3-8D53-292652C04121}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{98167041-8333-4947-9d72-d65d5a751c11} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35481B58-F46C-4254-B52C-FDC3001484C3} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1B7DE7A-4E77-43DB-AE78-96FC182FED4A}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6E796D86-376C-46FE-8381-43982EDD00FE}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4D10B48B-C531-4731-9BDE-B03C28E9C61C}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9EB34008-F34A-4D88-BD3A-0D597908C5A4}\ = "PSFactoryBuffer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EB34008-F34A-4D88-BD3A-0D597908C5A4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35481B58-F46C-4254-B52C-FDC3001484C3}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{959C5A99-177C-478E-8C3B-77E07E9BF3AA}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE5A9FEE-1C29-4AAE-A6B7-FEB0E4C96D5E}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9EB34008-F34A-4D88-BD3A-0D597908C5A4}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Tournament_Fixer\\AdditionalRuntimes\\lsmproxy.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{98167041-8333-4947-9d72-d65d5a751c11}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75A446C5-40B7-41D3-8D53-292652C04121}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{98167041-8333-4947-9d72-d65d5a751c11}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A8105B4F-7D5A-402B-AAC0-FD85DAECF94C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1A8A5D71-D95B-4DCD-915E-F9F6D31879AD} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CFC351CD-3795-458E-B590-34046794AB2F}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9052EEA-734F-41D8-978B-E32CAD12381A}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CFF90F7-F175-4277-BF0A-408906B22B75}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02E6EC4C-96E4-42E8-B533-336916A0087D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CFC351CD-3795-458E-B590-34046794AB2F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9052EEA-734F-41D8-978B-E32CAD12381A}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9EB34008-F34A-4D88-BD3A-0D597908C5A4}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{c2d3e131-c587-49b4-8bae-f0ee269eeb31} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A46A6E50-0994-4639-AADA-296488B58AC1}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{959C5A99-177C-478E-8C3B-77E07E9BF3AA} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5C45AA3-B042-4C7D-92D8-A454106844B7}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE5A9FEE-1C29-4AAE-A6B7-FEB0E4C96D5E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9EB34008-F34A-4D88-BD3A-0D597908C5A4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{c2d3e131-c587-49b4-8bae-f0ee269eeb31}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5C45AA3-B042-4C7D-92D8-A454106844B7}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EB34008-F34A-4D88-BD3A-0D597908C5A4}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A8105B4F-7D5A-402B-AAC0-FD85DAECF94C}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1B7DE7A-4E77-43DB-AE78-96FC182FED4A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{043C0DB0-345F-4715-BD44-BB53FE1CC603} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{043C0DB0-345F-4715-BD44-BB53FE1CC603}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{517F87FE-597A-4672-8555-6DAF1C8C788D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ABDE9756-B57E-4BD3-A393-C70F9ED04277}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1A8A5D71-D95B-4DCD-915E-F9F6D31879AD}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5C45AA3-B042-4C7D-92D8-A454106844B7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6344A5B7-EF1C-47BA-98B7-28C664427793}\ProxyStubClsid32 regsvr32.exe