Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220331-en -
submitted
04-04-2022 22:49
Static task
static1
Behavioral task
behavioral1
Sample
5e5fddeb89e6eb584b359d64f4a31500c857ecf5f40d3c9852edf14ecc4b80df.dll
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
General
-
Target
5e5fddeb89e6eb584b359d64f4a31500c857ecf5f40d3c9852edf14ecc4b80df.dll
-
Size
26KB
-
MD5
a3a71f7ab30e29aa3b35e25737660219
-
SHA1
df94f425cb83cb7227dd68f1a8f965fef343935c
-
SHA256
5e5fddeb89e6eb584b359d64f4a31500c857ecf5f40d3c9852edf14ecc4b80df
-
SHA512
d03d0024245ba63b2cc5e4abbf9fd652d9a94f03dbedf9e3b592df2a8cf5b9c9f6d631c18af5a6453f24f884a7e03bc81330cbb706e1541038b1da418ca4d44e
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Modifies registry class 60 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5e5fddeb89e6eb584b359d64f4a31500c857ecf5f40d3c9852edf14ecc4b80df.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5E5FDD~1.DLL" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CurVer\ = "BhoNew.Bho.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\VersionIndependentProgID\ = "BhoNew.Bho" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\ = "IBho" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\ = "_IBhoEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho.1\CLSID\ = "{1C1B8A44-61FE-411E-8F33-813A4E2E2984}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\ = "IBho" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\ = "Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\ = "_IBhoEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\ = "AVG Safe Search" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\ProgID\ = "BhoNew.Bho.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CLSID\ = "{1C1B8A44-61FE-411E-8F33-813A4E2E2984}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\ = "AVG Safe Search" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho.1\ = "AVG Safe Search" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 996 wrote to memory of 2000 996 regsvr32.exe regsvr32.exe PID 996 wrote to memory of 2000 996 regsvr32.exe regsvr32.exe PID 996 wrote to memory of 2000 996 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5e5fddeb89e6eb584b359d64f4a31500c857ecf5f40d3c9852edf14ecc4b80df.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5e5fddeb89e6eb584b359d64f4a31500c857ecf5f40d3c9852edf14ecc4b80df.dll2⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2000-124-0x0000000000000000-mapping.dmp