Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 08:28
Behavioral task
behavioral1
Sample
a42bf4f9e4e13d95913608946bfc5810c5ae04abd0a0053354d52ea3ba9e9e39.dll
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
a42bf4f9e4e13d95913608946bfc5810c5ae04abd0a0053354d52ea3ba9e9e39.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
a42bf4f9e4e13d95913608946bfc5810c5ae04abd0a0053354d52ea3ba9e9e39.dll
-
Size
176KB
-
MD5
443dffc39f520cb24513a80dabf20254
-
SHA1
e9a31e848051d2d8f93a7cedaf1a4707293fac30
-
SHA256
a42bf4f9e4e13d95913608946bfc5810c5ae04abd0a0053354d52ea3ba9e9e39
-
SHA512
6a5d30ff64eec9bb3c1f19a423a6854a8d28b87e58da1132d684f5bfb1edbc67e4388610f4284755e325eab323457b293ca8c79eecfed2ff65f5bf9d90286ee7
-
SSDEEP
3072:d4c+aFQGAOGWcroDwXrJsCkK3hYIQtHu1tW:dV+aFWOGWioDspzLmu1
Score
1/10
Malware Config
Signatures
-
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E4-B259-11CF-BFC7-444553540000}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E5-B259-11CF-BFC7-444553540000} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E5-B259-11CF-BFC7-444553540000}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E4-B259-11CF-BFC7-444553540000} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2768 regsvr32.exe 2768 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 2768 regsvr32.exe Token: SeCreateTokenPrivilege 2768 regsvr32.exe Token: SeAssignPrimaryTokenPrivilege 2768 regsvr32.exe Token: SeLockMemoryPrivilege 2768 regsvr32.exe Token: SeIncreaseQuotaPrivilege 2768 regsvr32.exe Token: SeMachineAccountPrivilege 2768 regsvr32.exe Token: SeTcbPrivilege 2768 regsvr32.exe Token: SeSecurityPrivilege 2768 regsvr32.exe Token: SeTakeOwnershipPrivilege 2768 regsvr32.exe Token: SeLoadDriverPrivilege 2768 regsvr32.exe Token: SeSystemProfilePrivilege 2768 regsvr32.exe Token: SeSystemtimePrivilege 2768 regsvr32.exe Token: SeProfSingleProcessPrivilege 2768 regsvr32.exe Token: SeIncBasePriorityPrivilege 2768 regsvr32.exe Token: SeCreatePagefilePrivilege 2768 regsvr32.exe Token: SeCreatePermanentPrivilege 2768 regsvr32.exe Token: SeBackupPrivilege 2768 regsvr32.exe Token: SeRestorePrivilege 2768 regsvr32.exe Token: SeShutdownPrivilege 2768 regsvr32.exe Token: SeDebugPrivilege 2768 regsvr32.exe Token: SeAuditPrivilege 2768 regsvr32.exe Token: SeSystemEnvironmentPrivilege 2768 regsvr32.exe Token: SeChangeNotifyPrivilege 2768 regsvr32.exe Token: SeRemoteShutdownPrivilege 2768 regsvr32.exe Token: SeUndockPrivilege 2768 regsvr32.exe Token: SeSyncAgentPrivilege 2768 regsvr32.exe Token: SeEnableDelegationPrivilege 2768 regsvr32.exe Token: SeManageVolumePrivilege 2768 regsvr32.exe Token: SeImpersonatePrivilege 2768 regsvr32.exe Token: SeCreateGlobalPrivilege 2768 regsvr32.exe Token: 31 2768 regsvr32.exe Token: 32 2768 regsvr32.exe Token: 33 2768 regsvr32.exe Token: 34 2768 regsvr32.exe Token: 35 2768 regsvr32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2768 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2856 wrote to memory of 2768 2856 regsvr32.exe 28 PID 2856 wrote to memory of 2768 2856 regsvr32.exe 28 PID 2856 wrote to memory of 2768 2856 regsvr32.exe 28 PID 2856 wrote to memory of 2768 2856 regsvr32.exe 28 PID 2856 wrote to memory of 2768 2856 regsvr32.exe 28 PID 2856 wrote to memory of 2768 2856 regsvr32.exe 28 PID 2856 wrote to memory of 2768 2856 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a42bf4f9e4e13d95913608946bfc5810c5ae04abd0a0053354d52ea3ba9e9e39.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\a42bf4f9e4e13d95913608946bfc5810c5ae04abd0a0053354d52ea3ba9e9e39.dll2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2768
-