594fc8b5a2d5a37f32b13ea8fadda28e48b11d942ed77e62d64e4ccef53637c5

Analysis

Target

594fc8b5a2d5a37f32b13ea8fadda28e48b11d942ed77e62d64e4ccef53637c5.dll
Size

7KB
MD5

737d49569cdcc51377ce4961096a08ee
SHA1

bf1f196f1bd66481f53a62a3ba216d975d7c3981
SHA256

594fc8b5a2d5a37f32b13ea8fadda28e48b11d942ed77e62d64e4ccef53637c5
SHA512

2f7ab854d2f5f33210cb3a885eb90e424718fb0c795931aeb226a46b2d9881056c65f647e8677c04877931125bed8370bc910a50f4058faaf9876f86f3611f61

Score

6^/10

adware stealer

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Modifies registry class 5 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\594fc8b5a2d5a37f32b13ea8fadda28e48b11d942ed77e62d64e4ccef53637c5.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\xxx = "xxx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

regsvr32.exe

pid process

2256 regsvr32.exe

pid	process
2256	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3920 wrote to memory of 2256	3920	regsvr32.exe	regsvr32.exe
PID 3920 wrote to memory of 2256	3920	regsvr32.exe	regsvr32.exe
PID 3920 wrote to memory of 2256	3920	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\594fc8b5a2d5a37f32b13ea8fadda28e48b11d942ed77e62d64e4ccef53637c5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3920

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact