Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/12/2024, 21:53
Behavioral task
behavioral1
Sample
035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll
Resource
win7-20240903-en
General
-
Target
035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll
-
Size
1.4MB
-
MD5
3b97ff9df423e25e55e619ab25aec98d
-
SHA1
3abf7065c456f1f0f731492b085709e17b8bad37
-
SHA256
035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d
-
SHA512
409635d198d5732094dd1e7b99d0386f8fe9d9fe710cfc6b5565de3a42c24b6ca7196f63192a34ef59969f5c52cd010944cd713e0af0f6f1fc52c0c3315893f5
-
SSDEEP
24576:SKit4aTOnCoUHbYbDzjJcvvNmIMlSE/p/SZjAygfc87LnwgT69gvmzmTWb:Bit7Onr8YVyNmdUEJSpkfvQgTsgvmB
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4576 regsvr32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe -
resource yara_rule behavioral2/memory/3564-1-0x00000000750E0000-0x000000007549A000-memory.dmp upx behavioral2/files/0x000c000000023b25-3.dat upx behavioral2/memory/4576-5-0x0000000000400000-0x000000000045B000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 3688 4576 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32mgr.exe -
Modifies registry class 62 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup.1.0\CLSID\ = "{653E37B1-9233-4435-96A2-60BAAD136F83}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup\CurVer\ = "VesnErrorLookup.VesnErrorLookup.1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\ExtendedErrors regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\VersionIndependentProgID\ = "VesnDB.Net Provider" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup.1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\TypeLib\ = "{844B00E1-3509-4380-9963-9D58E98E5AEC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\ = "VesnDBClient Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\OLE DB Provider regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\OLE DB Provider\ = "VesnDB.Net Provider" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net\CLSID\ = "{DB000001-1979-2001-2013-121388DB0001}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{DB000001-1979-2001-2013-121388DB000A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\VesnDB.DLL regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup\CLSID\ = "{653E37B1-9233-4435-96A2-60BAAD136F83}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net\ = "VesnDB.Net Provider" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\ExtendedErrors\{653E37B1-9233-4435-96A2-60BAAD136F83}\ = "VesnDB.Net Provider Error Lookup Service" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\ProgID\ = "VesnErrorLookup.VesnErrorLookup.1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net.1\ = "VesnDB.Net Provider" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\VesnDB.DLL\AppID = "{DB000001-1979-2001-2013-121388DB000A}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\ = "VesnErrorLookup Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net.1\CLSID\ = "{DB000001-1979-2001-2013-121388DB0001}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup.1.0\ = "VesnErrorLookup Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup\ = "VesnErrorLookup Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\VersionIndependentProgID\ = "VesnErrorLookup.VesnErrorLookup" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup.1.0\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\ = "VesnDB.Net" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\ExtendedErrors\{653E37B1-9233-4435-96A2-60BAAD136F83} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{DB000001-1979-2001-2013-121388DB000A}\ = "VesnDB" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\InprocServer32\ThreadingModel = "apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\AppID = "{844B00E1-3509-4380-9963-9D58E98E5AEC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\AppID = "{844B00E1-3509-4380-9963-9D58E98E5AEC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net\CurVer\ = "VesnDB.Net.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\ProgID\ = "VesnDB.Net.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3564 regsvr32.exe 3564 regsvr32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2588 wrote to memory of 3564 2588 regsvr32.exe 83 PID 2588 wrote to memory of 3564 2588 regsvr32.exe 83 PID 2588 wrote to memory of 3564 2588 regsvr32.exe 83 PID 3564 wrote to memory of 4576 3564 regsvr32.exe 84 PID 3564 wrote to memory of 4576 3564 regsvr32.exe 84 PID 3564 wrote to memory of 4576 3564 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4576 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 2644⤵
- Program crash
PID:3688
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4576 -ip 45761⤵PID:3188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD5dfb5daabb95dcfad1a5faf9ab1437076
SHA14a199569a9b52911bee7fb19ab80570cc5ff9ed1
SHA25654282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0
SHA5125d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8