Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 15:44
Static task
static1
Behavioral task
behavioral1
Sample
cfbf4dde5122b09c705a04ec1513fbe0N.dll
Resource
win7-20240729-en
General
-
Target
cfbf4dde5122b09c705a04ec1513fbe0N.dll
-
Size
1.6MB
-
MD5
cfbf4dde5122b09c705a04ec1513fbe0
-
SHA1
36dce3a9a4865d0c068cd8f0cbd62d0d298e22f2
-
SHA256
cf523e7fdf7ede7a2fb025f5cd9310d6a9416eaa519506eca2f831af5411e907
-
SHA512
11a6852aa2365c2d5a997589adb9a08406eb1ecff4b570886c138ea74b3fa71f1544737018357ea202edc1eb9152f5e6fb3d92a4a3403ecf52148176934e3b23
-
SSDEEP
24576:o22iw9ExmvSsEvNNmsOUkGHrb3UyzBEQXLn6ea+ewtwma25Xw0hZjjmp4vmExSt0:AAUGHZECejUha42M6TEbpQBx
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d613badf-b8b1-71f7-7f6e-89b6f88188a0} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d613badf-b8b1-71f7-7f6e-89b6f88188a0}\NoExplorer = "0" regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d613badf-b8b1-71f7-7f6e-89b6f88188a0}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cfbf4dde5122b09c705a04ec1513fbe0N.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d613badf-b8b1-71f7-7f6e-89b6f88188a0}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d613badf-b8b1-71f7-7f6e-89b6f88188a0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d613badf-b8b1-71f7-7f6e-89b6f88188a0}\ = "flvnetwork" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d613badf-b8b1-71f7-7f6e-89b6f88188a0}\InProcServer32 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4688 wrote to memory of 2884 4688 regsvr32.exe 83 PID 4688 wrote to memory of 2884 4688 regsvr32.exe 83 PID 4688 wrote to memory of 2884 4688 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\cfbf4dde5122b09c705a04ec1513fbe0N.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\cfbf4dde5122b09c705a04ec1513fbe0N.dll2⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2884
-