Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/12/2024, 21:47
Behavioral task
behavioral1
Sample
035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll
Resource
win7-20240903-en
General
-
Target
035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll
-
Size
1.4MB
-
MD5
3b97ff9df423e25e55e619ab25aec98d
-
SHA1
3abf7065c456f1f0f731492b085709e17b8bad37
-
SHA256
035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d
-
SHA512
409635d198d5732094dd1e7b99d0386f8fe9d9fe710cfc6b5565de3a42c24b6ca7196f63192a34ef59969f5c52cd010944cd713e0af0f6f1fc52c0c3315893f5
-
SSDEEP
24576:SKit4aTOnCoUHbYbDzjJcvvNmIMlSE/p/SZjAygfc87LnwgT69gvmzmTWb:Bit7Onr8YVyNmdUEJSpkfvQgTsgvmB
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4664 regsvr32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe -
resource yara_rule behavioral2/memory/3592-2-0x0000000074D80000-0x000000007513A000-memory.dmp upx behavioral2/files/0x0033000000023b88-4.dat upx behavioral2/memory/4664-5-0x0000000000400000-0x000000000045B000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 4496 4664 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32mgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 62 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup\CLSID\ = "{653E37B1-9233-4435-96A2-60BAAD136F83}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\OLE DB Provider regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\ = "VesnDBClient Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net\ = "VesnDB.Net Provider" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net\CLSID\ = "{DB000001-1979-2001-2013-121388DB0001}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\InprocServer32\ThreadingModel = "apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\ = "VesnErrorLookup Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\ExtendedErrors\{653E37B1-9233-4435-96A2-60BAAD136F83} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\ProgID\ = "VesnDB.Net.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup\ = "VesnErrorLookup Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\ExtendedErrors regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\VersionIndependentProgID\ = "VesnDB.Net Provider" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\ProgID\ = "VesnErrorLookup.VesnErrorLookup.1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\AppID = "{844B00E1-3509-4380-9963-9D58E98E5AEC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\ = "VesnDB.Net" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\OLE DB Provider\ = "VesnDB.Net Provider" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\VesnDB.DLL regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net.1\ = "VesnDB.Net Provider" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup.1.0\ = "VesnErrorLookup Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup.1.0\CLSID\ = "{653E37B1-9233-4435-96A2-60BAAD136F83}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net.1\CLSID\ = "{DB000001-1979-2001-2013-121388DB0001}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\AppID = "{844B00E1-3509-4380-9963-9D58E98E5AEC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\TypeLib\ = "{844B00E1-3509-4380-9963-9D58E98E5AEC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\ExtendedErrors\{653E37B1-9233-4435-96A2-60BAAD136F83}\ = "VesnDB.Net Provider Error Lookup Service" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup.1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup.1.0\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{DB000001-1979-2001-2013-121388DB000A}\ = "VesnDB" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup\CurVer\ = "VesnErrorLookup.VesnErrorLookup.1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net\CurVer\ = "VesnDB.Net.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{DB000001-1979-2001-2013-121388DB000A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\VersionIndependentProgID\ = "VesnErrorLookup.VesnErrorLookup" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\VesnDB.DLL\AppID = "{DB000001-1979-2001-2013-121388DB000A}" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3592 regsvr32.exe 3592 regsvr32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1208 wrote to memory of 3592 1208 regsvr32.exe 82 PID 1208 wrote to memory of 3592 1208 regsvr32.exe 82 PID 1208 wrote to memory of 3592 1208 regsvr32.exe 82 PID 3592 wrote to memory of 4664 3592 regsvr32.exe 83 PID 3592 wrote to memory of 4664 3592 regsvr32.exe 83 PID 3592 wrote to memory of 4664 3592 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4664 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 2644⤵
- Program crash
PID:4496
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4664 -ip 46641⤵PID:60
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD5dfb5daabb95dcfad1a5faf9ab1437076
SHA14a199569a9b52911bee7fb19ab80570cc5ff9ed1
SHA25654282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0
SHA5125d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8