Analysis
-
max time kernel
150s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 05:27
Static task
static1
Behavioral task
behavioral1
Sample
77fd5c549b0f824444cc44152febf1015759bba12ef0e4883309f64ea58dce4c.dll
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
General
-
Target
77fd5c549b0f824444cc44152febf1015759bba12ef0e4883309f64ea58dce4c.dll
-
Size
31KB
-
MD5
81c85d793629bc184015dde2ff4da92e
-
SHA1
ec373d32f96a491da79b82d27ae83dcde4728980
-
SHA256
77fd5c549b0f824444cc44152febf1015759bba12ef0e4883309f64ea58dce4c
-
SHA512
f1889ef7afbf386f4f7e9efd79579812ee8fca14ed4f9849226ae23248591f7bdd9d1971f6dc2d596e691d1988d150801829966be3ad6cc6a27bc0ecc5d492e1
-
SSDEEP
768:uj3Z6bPLh4neDysgPJ2o9ZfC50F7VRJpwB:aZ8/ysgP0OpC50Ftpw
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BEEF5075-64B8-437A-A9AC-288236BDFEE5} regsvr32.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\hosts regsvr32.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Search\SearchAssistant = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\sp.html" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\HOMEOldSP = "about:blank" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use Search Asst = "no" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use Custom Search URL = "1" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\sp.html" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Bar = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\sp.html" regsvr32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Search regsvr32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\sp.html" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\HOMEOldSP = "about:blank" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Use Search Asst = "no" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Use Custom Search URL = "1" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\sp.html" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Search regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\sp.html" regsvr32.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "about:blank" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "about:blank" regsvr32.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BEEF5075-64B8-437A-A9AC-288236BDFEE5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94AEFC77-4C9E-4A38-87C8-27AC4810B34C}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\77fd5c549b0f824444cc44152febf1015759bba12ef0e4883309f64ea58dce4c.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html\CLSID = "{94AEFC77-4C9E-4A38-87C8-27AC4810B34C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain\CLSID = "{94AEFC77-4C9E-4A38-87C8-27AC4810B34C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94AEFC77-4C9E-4A38-87C8-27AC4810B34C}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BEEF5075-64B8-437A-A9AC-288236BDFEE5}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BEEF5075-64B8-437A-A9AC-288236BDFEE5}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94AEFC77-4C9E-4A38-87C8-27AC4810B34C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94AEFC77-4C9E-4A38-87C8-27AC4810B34C}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BEEF5075-64B8-437A-A9AC-288236BDFEE5}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\77fd5c549b0f824444cc44152febf1015759bba12ef0e4883309f64ea58dce4c.dll" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1212 wrote to memory of 4568 1212 regsvr32.exe 79 PID 1212 wrote to memory of 4568 1212 regsvr32.exe 79 PID 1212 wrote to memory of 4568 1212 regsvr32.exe 79
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\77fd5c549b0f824444cc44152febf1015759bba12ef0e4883309f64ea58dce4c.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\77fd5c549b0f824444cc44152febf1015759bba12ef0e4883309f64ea58dce4c.dll2⤵
- Drops file in Drivers directory
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
PID:4568
-