062c7f979145590dd9ba1ae0d6fc8e18c4ff7af259975f6c4ac207fa99b5f32a

Analysis

Target

062c7f979145590dd9ba1ae0d6fc8e18c4ff7af259975f6c4ac207fa99b5f32a.dll
Size

8KB
MD5

8a2a1aafc86baa04e83d0d06d9e59372
SHA1

2da160334517eee1801b0709d4aba8e4612ef41e
SHA256

062c7f979145590dd9ba1ae0d6fc8e18c4ff7af259975f6c4ac207fa99b5f32a
SHA512

542693b959bd848640bf0b8f044983ddfe686218a179406fe17ed41d5e84b65e1c0fa9db3a54a08764c96524a1ceb79e7cbc77069a2ba59922bb2dd3c6c05c4f

Score

6^/10

adware stealer

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Modifies registry class 5 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{CFEE97A3-4911-444D-8BE8-E243A23D3DE2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CFEE97A3-4911-444D-8BE8-E243A23D3DE2}\www = "www"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{CFEE97A3-4911-444D-8BE8-E243A23D3DE2}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CFEE97A3-4911-444D-8BE8-E243A23D3DE2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\062c7f979145590dd9ba1ae0d6fc8e18c4ff7af259975f6c4ac207fa99b5f32a.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CFEE97A3-4911-444D-8BE8-E243A23D3DE2}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4752 wrote to memory of 3440	4752	regsvr32.exe	regsvr32.exe
PID 4752 wrote to memory of 3440	4752	regsvr32.exe	regsvr32.exe
PID 4752 wrote to memory of 3440	4752	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\062c7f979145590dd9ba1ae0d6fc8e18c4ff7af259975f6c4ac207fa99b5f32a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4752

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\062c7f979145590dd9ba1ae0d6fc8e18c4ff7af259975f6c4ac207fa99b5f32a.dll
2⤵
- Modifies registry class
PID:3440

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact