Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 05:50
Behavioral task
behavioral1
Sample
80d3dacf98c8a87ce4934c771458c4d2ad1733b5208477046894926dcbf64f3e.dll
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
80d3dacf98c8a87ce4934c771458c4d2ad1733b5208477046894926dcbf64f3e.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
80d3dacf98c8a87ce4934c771458c4d2ad1733b5208477046894926dcbf64f3e.dll
-
Size
176KB
-
MD5
19b2e10f6d8ab097710681af26f11597
-
SHA1
90a7cefd008fd056193ac63b2a12a54f1a12cea4
-
SHA256
80d3dacf98c8a87ce4934c771458c4d2ad1733b5208477046894926dcbf64f3e
-
SHA512
afe256d8d38b4dcfe5cf51ccb01ee852340fe460d0d2a874662cde87b214c9f9e4deb0cad7e51582bdb37a8c5bb7f3a9994b661c9b65efa5675d8e0d8c32834b
-
SSDEEP
3072:n4c+aFQGAOGWcroDwXrJsCkK3hYIQtHu1tW:nV+aFWOGWioDspzLmu1
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E4-B259-11CF-BFC7-444553540000} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E4-B259-11CF-BFC7-444553540000}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E5-B259-11CF-BFC7-444553540000} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E5-B259-11CF-BFC7-444553540000}\InProcServer32 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2364 regsvr32.exe 2364 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 2364 regsvr32.exe Token: SeCreateTokenPrivilege 2364 regsvr32.exe Token: SeAssignPrimaryTokenPrivilege 2364 regsvr32.exe Token: SeLockMemoryPrivilege 2364 regsvr32.exe Token: SeIncreaseQuotaPrivilege 2364 regsvr32.exe Token: SeMachineAccountPrivilege 2364 regsvr32.exe Token: SeTcbPrivilege 2364 regsvr32.exe Token: SeSecurityPrivilege 2364 regsvr32.exe Token: SeTakeOwnershipPrivilege 2364 regsvr32.exe Token: SeLoadDriverPrivilege 2364 regsvr32.exe Token: SeSystemProfilePrivilege 2364 regsvr32.exe Token: SeSystemtimePrivilege 2364 regsvr32.exe Token: SeProfSingleProcessPrivilege 2364 regsvr32.exe Token: SeIncBasePriorityPrivilege 2364 regsvr32.exe Token: SeCreatePagefilePrivilege 2364 regsvr32.exe Token: SeCreatePermanentPrivilege 2364 regsvr32.exe Token: SeBackupPrivilege 2364 regsvr32.exe Token: SeRestorePrivilege 2364 regsvr32.exe Token: SeShutdownPrivilege 2364 regsvr32.exe Token: SeDebugPrivilege 2364 regsvr32.exe Token: SeAuditPrivilege 2364 regsvr32.exe Token: SeSystemEnvironmentPrivilege 2364 regsvr32.exe Token: SeChangeNotifyPrivilege 2364 regsvr32.exe Token: SeRemoteShutdownPrivilege 2364 regsvr32.exe Token: SeUndockPrivilege 2364 regsvr32.exe Token: SeSyncAgentPrivilege 2364 regsvr32.exe Token: SeEnableDelegationPrivilege 2364 regsvr32.exe Token: SeManageVolumePrivilege 2364 regsvr32.exe Token: SeImpersonatePrivilege 2364 regsvr32.exe Token: SeCreateGlobalPrivilege 2364 regsvr32.exe Token: 31 2364 regsvr32.exe Token: 32 2364 regsvr32.exe Token: 33 2364 regsvr32.exe Token: 34 2364 regsvr32.exe Token: 35 2364 regsvr32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2364 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2364 2528 regsvr32.exe 29 PID 2528 wrote to memory of 2364 2528 regsvr32.exe 29 PID 2528 wrote to memory of 2364 2528 regsvr32.exe 29 PID 2528 wrote to memory of 2364 2528 regsvr32.exe 29 PID 2528 wrote to memory of 2364 2528 regsvr32.exe 29 PID 2528 wrote to memory of 2364 2528 regsvr32.exe 29 PID 2528 wrote to memory of 2364 2528 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\80d3dacf98c8a87ce4934c771458c4d2ad1733b5208477046894926dcbf64f3e.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\80d3dacf98c8a87ce4934c771458c4d2ad1733b5208477046894926dcbf64f3e.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2364
-