Analysis
-
max time kernel
31s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
27-04-2022 16:05
Static task
static1
Behavioral task
behavioral1
Sample
8621da0999f3e2606af2c2dbd611826617027de4320cccef89ff59c71183560a.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
8621da0999f3e2606af2c2dbd611826617027de4320cccef89ff59c71183560a.dll
-
Size
7KB
-
MD5
1bd80fc494ee1490467b5e0cb9743d92
-
SHA1
f4d2fea98a83c356d29330be9f05d802c88931a4
-
SHA256
8621da0999f3e2606af2c2dbd611826617027de4320cccef89ff59c71183560a
-
SHA512
d94d6cb96c0c0332ab3cb9807ed120ebc617929c385b346188eac1c45386df5b21a6c5c7172a1bcd3c2887b058c833cc20656542975629ea7512a54c41eb2806
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Modifies registry class 5 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8621da0999f3e2606af2c2dbd611826617027de4320cccef89ff59c71183560a.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\xxx = "xxx" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1356 wrote to memory of 280 1356 regsvr32.exe regsvr32.exe PID 1356 wrote to memory of 280 1356 regsvr32.exe regsvr32.exe PID 1356 wrote to memory of 280 1356 regsvr32.exe regsvr32.exe PID 1356 wrote to memory of 280 1356 regsvr32.exe regsvr32.exe PID 1356 wrote to memory of 280 1356 regsvr32.exe regsvr32.exe PID 1356 wrote to memory of 280 1356 regsvr32.exe regsvr32.exe PID 1356 wrote to memory of 280 1356 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8621da0999f3e2606af2c2dbd611826617027de4320cccef89ff59c71183560a.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\8621da0999f3e2606af2c2dbd611826617027de4320cccef89ff59c71183560a.dll2⤵
- Modifies registry class