Analysis
-
max time kernel
40s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
27-05-2022 23:17
Static task
static1
Behavioral task
behavioral1
Sample
a4efe529bfed95acdba54c0af6a9fe330f2ca58e1c893980cb1e750e80e5e754.dll
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
a4efe529bfed95acdba54c0af6a9fe330f2ca58e1c893980cb1e750e80e5e754.dll
-
Size
296KB
-
MD5
03cd6c7bd1a69cc1814f464bf6cb2b90
-
SHA1
39d7e9fa83afa08067d8def0582adcf72e5c94a1
-
SHA256
a4efe529bfed95acdba54c0af6a9fe330f2ca58e1c893980cb1e750e80e5e754
-
SHA512
535305503db21964e5a7fc3e0a859cfb4a3463e5ee90b7f100bf29d0ccba5daca79a9c3515b7cfc163e26bfa889649cbc689cf092139d86387163c3229070c45
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Modifies registry class 64 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PSText.DLL\AppID = "{E89A07B5-BD7A-43F9-BDA4-0DAA48AC4FA5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21608B66-026F-4DCB-9244-0DACA328DCED}\ProgID\ = "PlaySushi32.PlaySushi.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{975BBCC0-19DF-47C2-9AE2-D78EEFA96821} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21608B66-026F-4DCB-9244-0DACA328DCED}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45A8F904-D9CA-439B-9CBB-11097B45D9E1}\ = "IIEButton" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PlaySushi32.PlaySushi.1\ = "PlaySushi" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{975BBCC0-19DF-47C2-9AE2-D78EEFA96821}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45A8F904-D9CA-439B-9CBB-11097B45D9E1} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45A8F904-D9CA-439B-9CBB-11097B45D9E1}\TypeLib\ = "{975BBCC0-19DF-47C2-9AE2-D78EEFA96821}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PSText.IEButton\CurVer\ = "PSText.IEButton.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21608B66-026F-4DCB-9244-0DACA328DCED}\ = "PlaySushi" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{975BBCC0-19DF-47C2-9AE2-D78EEFA96821}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F165085B-6B85-4AD5-AD00-95552A823F6D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F165085B-6B85-4AD5-AD00-95552A823F6D}\TypeLib\ = "{975BBCC0-19DF-47C2-9AE2-D78EEFA96821}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PSText.IEButton\CLSID\ = "{EBD24BD3-E272-4FA3-A8BA-C5D709757CAB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21608B66-026F-4DCB-9244-0DACA328DCED} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21608B66-026F-4DCB-9244-0DACA328DCED}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F165085B-6B85-4AD5-AD00-95552A823F6D}\TypeLib\ = "{975BBCC0-19DF-47C2-9AE2-D78EEFA96821}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5272CCD4-4199-4B04-BF68-B28A0DCF0151} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45A8F904-D9CA-439B-9CBB-11097B45D9E1}\TypeLib\ = "{975BBCC0-19DF-47C2-9AE2-D78EEFA96821}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PSText.IEButton.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PlaySushi32.PlaySushi.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PlaySushi32.PlaySushi\ = "PlaySushi" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F165085B-6B85-4AD5-AD00-95552A823F6D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5272CCD4-4199-4B04-BF68-B28A0DCF0151}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PSText.IEButton\ = "IEButton Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PSText.IEButton\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBD24BD3-E272-4FA3-A8BA-C5D709757CAB}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21608B66-026F-4DCB-9244-0DACA328DCED}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21608B66-026F-4DCB-9244-0DACA328DCED}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21608B66-026F-4DCB-9244-0DACA328DCED}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a4efe529bfed95acdba54c0af6a9fe330f2ca58e1c893980cb1e750e80e5e754.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F165085B-6B85-4AD5-AD00-95552A823F6D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5272CCD4-4199-4B04-BF68-B28A0DCF0151}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5272CCD4-4199-4B04-BF68-B28A0DCF0151} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45A8F904-D9CA-439B-9CBB-11097B45D9E1}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PSText.IEButton regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PlaySushi32.PlaySushi.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PlaySushi32.PlaySushi regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21608B66-026F-4DCB-9244-0DACA328DCED}\VersionIndependentProgID\ = "PlaySushi32.PlaySushi" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{975BBCC0-19DF-47C2-9AE2-D78EEFA96821}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F165085B-6B85-4AD5-AD00-95552A823F6D}\ = "_IPluginEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F165085B-6B85-4AD5-AD00-95552A823F6D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5272CCD4-4199-4B04-BF68-B28A0DCF0151}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PSText.IEButton.1\ = "IEButton Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBD24BD3-E272-4FA3-A8BA-C5D709757CAB}\ = "GoPlaySushi" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBD24BD3-E272-4FA3-A8BA-C5D709757CAB}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21608B66-026F-4DCB-9244-0DACA328DCED}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45A8F904-D9CA-439B-9CBB-11097B45D9E1}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45A8F904-D9CA-439B-9CBB-11097B45D9E1}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{975BBCC0-19DF-47C2-9AE2-D78EEFA96821}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{975BBCC0-19DF-47C2-9AE2-D78EEFA96821}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F165085B-6B85-4AD5-AD00-95552A823F6D}\ = "_IPluginEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5272CCD4-4199-4B04-BF68-B28A0DCF0151}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45A8F904-D9CA-439B-9CBB-11097B45D9E1} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45A8F904-D9CA-439B-9CBB-11097B45D9E1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBD24BD3-E272-4FA3-A8BA-C5D709757CAB}\ProgID\ = "PSText.IEButton.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PlaySushi32.PlaySushi\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PlaySushi32.PlaySushi\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21608B66-026F-4DCB-9244-0DACA328DCED}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F165085B-6B85-4AD5-AD00-95552A823F6D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45A8F904-D9CA-439B-9CBB-11097B45D9E1}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{E89A07B5-BD7A-43F9-BDA4-0DAA48AC4FA5}\ = "PlaySushi32" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PSText.IEButton\CLSID regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1672 wrote to memory of 1120 1672 regsvr32.exe regsvr32.exe PID 1672 wrote to memory of 1120 1672 regsvr32.exe regsvr32.exe PID 1672 wrote to memory of 1120 1672 regsvr32.exe regsvr32.exe PID 1672 wrote to memory of 1120 1672 regsvr32.exe regsvr32.exe PID 1672 wrote to memory of 1120 1672 regsvr32.exe regsvr32.exe PID 1672 wrote to memory of 1120 1672 regsvr32.exe regsvr32.exe PID 1672 wrote to memory of 1120 1672 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a4efe529bfed95acdba54c0af6a9fe330f2ca58e1c893980cb1e750e80e5e754.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\a4efe529bfed95acdba54c0af6a9fe330f2ca58e1c893980cb1e750e80e5e754.dll2⤵
- Modifies registry class