Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
344017993/D...lp.htm
windows7-x64
144017993/D...lp.htm
windows10-2004-x64
144017993/D....2.exe
windows7-x64
144017993/D....2.exe
windows10-2004-x64
144017993/c...ge.url
windows7-x64
144017993/c...ge.url
windows10-2004-x64
144017993/c...rd.exe
windows7-x64
144017993/c...rd.exe
windows10-2004-x64
144017993/c...32.dll
windows7-x64
144017993/c...32.dll
windows10-2004-x64
144017993/�...lp.htm
windows7-x64
144017993/�...lp.htm
windows10-2004-x64
144017993/�....2.exe
windows7-x64
144017993/�....2.exe
windows10-2004-x64
144017993/�...it.vbs
windows7-x64
144017993/�...it.vbs
windows10-2004-x64
144017993/�...pp.exe
windows7-x64
144017993/�...pp.exe
windows10-2004-x64
144017993/�...ng.vbs
windows7-x64
144017993/�...ng.vbs
windows10-2004-x64
144017993/�...in.vbs
windows7-x64
144017993/�...in.vbs
windows10-2004-x64
144017993/�...RT.exe
windows7-x64
144017993/�...RT.exe
windows10-2004-x64
144017993/�...Io.dll
windows7-x64
144017993/�...Io.dll
windows10-2004-x64
144017993/�...Io.sys
windows7-x64
144017993/�...Io.sys
windows10-2004-x64
144017993/�...ra.vbs
windows7-x64
144017993/�...ra.vbs
windows10-2004-x64
144017993/�...ps.vbs
windows7-x64
144017993/�...ps.vbs
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 18:01
Static task
static1
Behavioral task
behavioral1
Sample
44017993/DownMe.com_12804scommv22/串口调试助手/help.htm
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
44017993/DownMe.com_12804scommv22/串口调试助手/help.htm
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
44017993/DownMe.com_12804scommv22/串口调试助手/串口调试助手V2.2.exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
44017993/DownMe.com_12804scommv22/串口调试助手/串口调试助手V2.2.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
44017993/comwizard/Century Soar Homepage.url
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
44017993/comwizard/Century Soar Homepage.url
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
44017993/comwizard/ComWizard.exe
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
44017993/comwizard/ComWizard.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
44017993/comwizard/MSCOMM32.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
44017993/comwizard/MSCOMM32.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
44017993/串口调试助手V2.2/help.htm
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
44017993/串口调试助手V2.2/help.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
44017993/串口调试助手V2.2/串口调试助手V2.2.exe
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
44017993/串口调试助手V2.2/串口调试助手V2.2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
44017993/第1章 串口编程调试精灵/Hexedit.vbs
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
44017993/第1章 串口编程调试精灵/Hexedit.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
44017993/第1章 串口编程调试精灵/SerialApp.exe
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
44017993/第1章 串口编程调试精灵/SerialApp.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
44017993/第1章 串口编程调试精灵/dlgSetting.vbs
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
44017993/第1章 串口编程调试精灵/dlgSetting.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
44017993/第1章 串口编程调试精灵/frmMain.vbs
Resource
win7-20240611-en
Behavioral task
behavioral22
Sample
44017993/第1章 串口编程调试精灵/frmMain.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
44017993/第2章 智能安防报警系统/ALERT.exe
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
44017993/第2章 智能安防报警系统/ALERT.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
44017993/第2章 智能安防报警系统/WinIo.dll
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
44017993/第2章 智能安防报警系统/WinIo.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
44017993/第2章 智能安防报警系统/WinIo.sys
Resource
win7-20240611-en
Behavioral task
behavioral28
Sample
44017993/第2章 智能安防报警系统/WinIo.sys
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
44017993/第2章 智能安防报警系统/frmBufpara.vbs
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
44017993/第2章 智能安防报警系统/frmBufpara.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
44017993/第2章 智能安防报警系统/frmCommProps.vbs
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
44017993/第2章 智能安防报警系统/frmCommProps.vbs
Resource
win10v2004-20240611-en
General
-
Target
44017993/comwizard/MSCOMM32.dll
-
Size
94KB
-
MD5
6c70cb243167b9cb7022400e02d67541
-
SHA1
fe9fc7ef8a5dfbef105c344431776a090fbd8e8c
-
SHA256
d8f4a3ef01f559dedef663b6c4d03da8894be3175e736fdec9e8fd6651a64665
-
SHA512
ecb0887b38da7e80de539e1f40cae0c76c8441ff06d423f84d937ed7de50e1e08d0ac43b650c36b51fa1499b7fb2e6916d5ea6790c3e64984813030e1acf769c
-
SSDEEP
1536:YXuy5KT+uoUML9j3ZJb0M7h6isxitRHrkDj5qJ4UGyKbGubL:YXv5KKJfh30DxAtYDYJ4UGyGTbL
Malware Config
Signatures
-
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\44017993\\comwizard\\MSCOMM32.dll, 1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5604-2C6E-101B-82B6-000000000014}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D0FC8A81-2CB2-101B-82B6-000000000014}\ = "MSComm Hardware Propery Page Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\ = "IMSComm" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{648A5603-2C6E-101B-82B6-000000000014}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{648A5602-2C6E-101B-82B6-000000000014}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSCOMMLib.MSComm\CLSID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E0DC8C80-3486-101B-82B6-000000000014} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{648A5602-2C6E-101B-82B6-000000000014}\TypeLib\Version = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\44017993\\comwizard\\MSCOMM32.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\MiscStatus regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\ToolboxBitmap32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}\1.1\FLAGS\ = "2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}\1.1\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\ = "IMSComm" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E0DC8C80-3486-101B-82B6-000000000014}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}\1.1\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{648A5603-2C6E-101B-82B6-000000000014}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E0DC8C80-3486-101B-82B6-000000000014}\ = "MSComm Buffers Propery Page Object" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D0FC8A81-2CB2-101B-82B6-000000000014} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{648A5602-2C6E-101B-82B6-000000000014}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSCOMMLib.MSComm\CurVer\ = "MSCOMMLib.MSComm.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSCOMMLib.MSComm.1\ = "Microsoft Communications Control, version 5.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}\1.1\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\MiscStatus\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\MiscStatus\1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5604-2C6E-101B-82B6-000000000014} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5604-2C6E-101B-82B6-000000000014}\ = "MSComm General Propery Page Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSCOMMLib.MSComm regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\MiscStatus\1\ = "132497" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D0FC8A81-2CB2-101B-82B6-000000000014}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{648A5602-2C6E-101B-82B6-000000000014}\ = "DMSCommEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{648A5602-2C6E-101B-82B6-000000000014}\TypeLib\Version = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\ProgID\ = "MSCOMMLib.MSComm.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}\1.1\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\44017993\\comwizard" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E90-DF38-11CF-8E74-00A0C90F26F8} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{648A5602-2C6E-101B-82B6-000000000014}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{648A5602-2C6E-101B-82B6-000000000014}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{648A5602-2C6E-101B-82B6-000000000014}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\ = "Microsoft Communications Control, version 5.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSCOMMLib.MSComm\CLSID\ = "{648A5600-2C6E-101B-82B6-000000000014}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\VersionIndependentProgID\ = "MSCOMMLib.MSComm" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}\1.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}\1.1\ = "Microsoft Comm Control 5.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{648A5602-2C6E-101B-82B6-000000000014}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\InprocServer32 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2820 2060 regsvr32.exe 28 PID 2060 wrote to memory of 2820 2060 regsvr32.exe 28 PID 2060 wrote to memory of 2820 2060 regsvr32.exe 28 PID 2060 wrote to memory of 2820 2060 regsvr32.exe 28 PID 2060 wrote to memory of 2820 2060 regsvr32.exe 28 PID 2060 wrote to memory of 2820 2060 regsvr32.exe 28 PID 2060 wrote to memory of 2820 2060 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\44017993\comwizard\MSCOMM32.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\44017993\comwizard\MSCOMM32.dll2⤵
- Modifies registry class
PID:2820
-