Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 03:49
Static task
static1
Behavioral task
behavioral1
Sample
e52c7ee2e12c78f79dd30bdb02a7e1e0N.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e52c7ee2e12c78f79dd30bdb02a7e1e0N.dll
Resource
win10v2004-20240802-en
General
-
Target
e52c7ee2e12c78f79dd30bdb02a7e1e0N.dll
-
Size
128KB
-
MD5
e52c7ee2e12c78f79dd30bdb02a7e1e0
-
SHA1
19d9915e89e84c9bb9e7f61eac8b0827e0036b23
-
SHA256
204fce7d9d970626371d8d20cd7be20cc2163bdb3fd1a649d628531a15c60bca
-
SHA512
6d8d8dd7ab3d1ae37b8a5cca76ec881116fb27ea789c427f1aa3150f9f5423e57349894a84bd4594141f75d57ebe696db9c900618a1b6ede6e82b60287917220
-
SSDEEP
3072:e7EDwoxqKMbGezpqCZjAQcu7sJcEUyOaeG30zVZtFPk3:eQEKs0CZEQcUxEUyOaeG3iF
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{64985CCA-43B0-4815-A4B8-C61C06F963B6} regsvr32.exe -
Modifies registry class 45 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\union.YzUrlTran\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{64985CCA-43B0-4815-A4B8-C61C06F963B6}\ = "YzUrlTran Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{64985CCA-43B0-4815-A4B8-C61C06F963B6}\ProgID\ = "union.YzUrlTran.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{80FB8E6D-D471-4013-A771-D83CD1944984} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{80FB8E6D-D471-4013-A771-D83CD1944984}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\union.YzUrlTran regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\union.YzUrlTran\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{64985CCA-43B0-4815-A4B8-C61C06F963B6}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{64985CCA-43B0-4815-A4B8-C61C06F963B6}\TypeLib\ = "{DDCE79B6-EEA5-4F60-A0F0-08BC06C14D06}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DDCE79B6-EEA5-4F60-A0F0-08BC06C14D06}\1.0\ = "union 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{80FB8E6D-D471-4013-A771-D83CD1944984}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{80FB8E6D-D471-4013-A771-D83CD1944984}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\union.YzUrlTran.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{80FB8E6D-D471-4013-A771-D83CD1944984}\ = "IYzUnion" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{80FB8E6D-D471-4013-A771-D83CD1944984}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DDCE79B6-EEA5-4F60-A0F0-08BC06C14D06}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\union.YzUrlTran.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\union.YzUrlTran\CurVer\ = "union.YzUrlTran.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{64985CCA-43B0-4815-A4B8-C61C06F963B6}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{64985CCA-43B0-4815-A4B8-C61C06F963B6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e52c7ee2e12c78f79dd30bdb02a7e1e0N.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{64985CCA-43B0-4815-A4B8-C61C06F963B6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{64985CCA-43B0-4815-A4B8-C61C06F963B6}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DDCE79B6-EEA5-4F60-A0F0-08BC06C14D06}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{80FB8E6D-D471-4013-A771-D83CD1944984}\ = "IYzUnion" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{80FB8E6D-D471-4013-A771-D83CD1944984}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DDCE79B6-EEA5-4F60-A0F0-08BC06C14D06}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\union.YzUrlTran.1\ = "YzUrlTran Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DDCE79B6-EEA5-4F60-A0F0-08BC06C14D06}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{80FB8E6D-D471-4013-A771-D83CD1944984}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{80FB8E6D-D471-4013-A771-D83CD1944984}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\union.YzUrlTran.1\CLSID\ = "{64985CCA-43B0-4815-A4B8-C61C06F963B6}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{64985CCA-43B0-4815-A4B8-C61C06F963B6}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{64985CCA-43B0-4815-A4B8-C61C06F963B6}\VersionIndependentProgID\ = "union.YzUrlTran" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DDCE79B6-EEA5-4F60-A0F0-08BC06C14D06} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DDCE79B6-EEA5-4F60-A0F0-08BC06C14D06}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DDCE79B6-EEA5-4F60-A0F0-08BC06C14D06}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DDCE79B6-EEA5-4F60-A0F0-08BC06C14D06}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{80FB8E6D-D471-4013-A771-D83CD1944984}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\union.YzUrlTran\ = "YzUrlTran Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\union.YzUrlTran\CLSID\ = "{64985CCA-43B0-4815-A4B8-C61C06F963B6}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{64985CCA-43B0-4815-A4B8-C61C06F963B6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DDCE79B6-EEA5-4F60-A0F0-08BC06C14D06}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e52c7ee2e12c78f79dd30bdb02a7e1e0N.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{80FB8E6D-D471-4013-A771-D83CD1944984}\TypeLib\ = "{DDCE79B6-EEA5-4F60-A0F0-08BC06C14D06}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{80FB8E6D-D471-4013-A771-D83CD1944984} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{80FB8E6D-D471-4013-A771-D83CD1944984}\TypeLib\ = "{DDCE79B6-EEA5-4F60-A0F0-08BC06C14D06}" regsvr32.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 2764 regsvr32.exe 476 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 2764 regsvr32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2764 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2764 2672 regsvr32.exe 30 PID 2672 wrote to memory of 2764 2672 regsvr32.exe 30 PID 2672 wrote to memory of 2764 2672 regsvr32.exe 30 PID 2672 wrote to memory of 2764 2672 regsvr32.exe 30 PID 2672 wrote to memory of 2764 2672 regsvr32.exe 30 PID 2672 wrote to memory of 2764 2672 regsvr32.exe 30 PID 2672 wrote to memory of 2764 2672 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e52c7ee2e12c78f79dd30bdb02a7e1e0N.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e52c7ee2e12c78f79dd30bdb02a7e1e0N.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2764
-