Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2024, 02:47
Static task
static1
Behavioral task
behavioral1
Sample
uninstall.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
uninstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
winpnp.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
winpnp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
winpnps.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
winpnps.exe
Resource
win10v2004-20240802-en
General
-
Target
winpnp.dll
-
Size
893KB
-
MD5
bdbe99254afa47224f49e3db59faaae2
-
SHA1
19e4aae4ad4cd5c7e4ceafa49557747c5b148ab0
-
SHA256
b017009fd4533fc82b1c2ee4601a8f78b7043b9f38122f89161d61f3dc19823c
-
SHA512
ee5d152e211ef79c1ab714624b9c162eb62b36fcbc91285df60055d74943a529d76eab4168542ecb72b293be824a64438a1ff0f5aa3d6b87c9858ed0016c2097
-
SSDEEP
12288:HJRmqKSL3zRdnujhwpG7TqhoH5fc2oXwAezy+vI6HzrUOYt1SHk7YSxAgpELW2D:pcqKMmEG7Os5fAXwAeO+vIi2JvAgWW
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6F2BD1DC-B030-4656-8847-E75037CA9C13} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6F2BD1DC-B030-4656-8847-E75037CA9C13}\NoExplorer = "1" regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 11 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\winpnp.P\Clsid\ = "{6F2BD1DC-B030-4656-8847-E75037CA9C13}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F2BD1DC-B030-4656-8847-E75037CA9C13}\ProgID\ = "winpnp.P" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F2BD1DC-B030-4656-8847-E75037CA9C13}\ = "O" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F2BD1DC-B030-4656-8847-E75037CA9C13}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F2BD1DC-B030-4656-8847-E75037CA9C13}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\winpnp.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F2BD1DC-B030-4656-8847-E75037CA9C13}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F2BD1DC-B030-4656-8847-E75037CA9C13}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F2BD1DC-B030-4656-8847-E75037CA9C13} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\winpnp.P regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\winpnp.P\ = "O" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\winpnp.P\Clsid regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1236 wrote to memory of 392 1236 regsvr32.exe 86 PID 1236 wrote to memory of 392 1236 regsvr32.exe 86 PID 1236 wrote to memory of 392 1236 regsvr32.exe 86
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\winpnp.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\winpnp.dll2⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:392
-