Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
56s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 11:22
Static task
static1
Behavioral task
behavioral1
Sample
Outlook_4.83.901.0_20231017/outlka23.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Outlook_4.83.901.0_20231017/outlka23.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
Outlook_4.83.901.0_20231017/outlka64.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
Outlook_4.83.901.0_20231017/outlka64.dll
Resource
win10v2004-20240508-en
General
-
Target
Outlook_4.83.901.0_20231017/outlka64.dll
-
Size
5.9MB
-
MD5
20dba31f4e211f6bea144a0d2880cc6e
-
SHA1
cdc90d1742b1a25487c2d3628103f80cfbc1a284
-
SHA256
2fe16173326ea26ff89df46c061afea8b7bad2b540e8db5bd578f44f85e6933d
-
SHA512
57885b1e08371fbe1e51e1f614f059437083219fac87c8f1c3c52c911ea205c6a6d09bfb7cc16da247023e2cfb8c4ed5f4f97fd1f3da5d04bd277d305a5a6483
-
SSDEEP
98304:rfylCoe3XL+0a4Lyx+9QKiuFWJ6pCsbM23XsDM:DWCoe3Ze+t5FWJ6pZbMyc
Malware Config
Signatures
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\ProgID\ = "OL2003Addin.Addin.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin\ = "Addin Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\TypeLib\ = "{EC7B995D-7EFE-412A-8D3A-B3810BB97821}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\VersionIndependentProgID\ = "OL2003Addin.Addin" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Outlook_4.83.901.0_20231017\\outlka64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\ = "OL2003Addin 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\TypeLib\ = "{EC7B995D-7EFE-412A-8D3A-B3810BB97821}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin.1\ = "Addin Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\ = "IAddin" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\ = "IAddin" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin.1\CLSID\ = "{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin\CLSID\ = "{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\ = "Addin Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Outlook_4.83.901.0_20231017\\outlka64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Outlook_4.83.901.0_20231017" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\TypeLib\ = "{EC7B995D-7EFE-412A-8D3A-B3810BB97821}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin\CurVer\ = "OL2003Addin.Addin.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\TypeLib\Version = "1.0" regsvr32.exe