Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
84s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 15:44
Static task
static1
Behavioral task
behavioral1
Sample
cfbf4dde5122b09c705a04ec1513fbe0N.dll
Resource
win7-20240729-en
General
-
Target
cfbf4dde5122b09c705a04ec1513fbe0N.dll
-
Size
1.6MB
-
MD5
cfbf4dde5122b09c705a04ec1513fbe0
-
SHA1
36dce3a9a4865d0c068cd8f0cbd62d0d298e22f2
-
SHA256
cf523e7fdf7ede7a2fb025f5cd9310d6a9416eaa519506eca2f831af5411e907
-
SHA512
11a6852aa2365c2d5a997589adb9a08406eb1ecff4b570886c138ea74b3fa71f1544737018357ea202edc1eb9152f5e6fb3d92a4a3403ecf52148176934e3b23
-
SSDEEP
24576:o22iw9ExmvSsEvNNmsOUkGHrb3UyzBEQXLn6ea+ewtwma25Xw0hZjjmp4vmExSt0:AAUGHZECejUha42M6TEbpQBx
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0d0f747c-dc50-7658-7e63-847549a71aa2} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0d0f747c-dc50-7658-7e63-847549a71aa2}\NoExplorer = "0" regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0d0f747c-dc50-7658-7e63-847549a71aa2}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0d0f747c-dc50-7658-7e63-847549a71aa2}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cfbf4dde5122b09c705a04ec1513fbe0N.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0d0f747c-dc50-7658-7e63-847549a71aa2}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0d0f747c-dc50-7658-7e63-847549a71aa2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0d0f747c-dc50-7658-7e63-847549a71aa2}\ = "flvnetwork" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1308 wrote to memory of 2556 1308 regsvr32.exe 29 PID 1308 wrote to memory of 2556 1308 regsvr32.exe 29 PID 1308 wrote to memory of 2556 1308 regsvr32.exe 29 PID 1308 wrote to memory of 2556 1308 regsvr32.exe 29 PID 1308 wrote to memory of 2556 1308 regsvr32.exe 29 PID 1308 wrote to memory of 2556 1308 regsvr32.exe 29 PID 1308 wrote to memory of 2556 1308 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\cfbf4dde5122b09c705a04ec1513fbe0N.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\cfbf4dde5122b09c705a04ec1513fbe0N.dll2⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2556
-