Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2022 05:45
Static task
static1
Behavioral task
behavioral1
Sample
5a6aaa89814402ca4cff2cd1d19c4393e1326c054dac7a4768a688100e76905c.dll
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
General
-
Target
5a6aaa89814402ca4cff2cd1d19c4393e1326c054dac7a4768a688100e76905c.dll
-
Size
148KB
-
MD5
701716c4ec02ad9a0b277da11c6e2800
-
SHA1
70755ee0997c25672405611f7bb7d522c24dc83f
-
SHA256
5a6aaa89814402ca4cff2cd1d19c4393e1326c054dac7a4768a688100e76905c
-
SHA512
6e4e9aae51d8323638931c75474b9e00685d307e8f9ecf06ace18c38d377daec4bb6d7242ec7b1019973733917390e17f036732541ee9291bed57aea0490e5e5
-
SSDEEP
3072:eCTRH5QGfzz4U6ZlK/AbN8LMCvTdoWYv41lmDhP:e6HHz7/hLMwYw1l
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0} regsvr32.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system.ini regsvr32.exe -
Modifies registry class 31 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\ = "Pbtoo2s 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5a6aaa89814402ca4cff2cd1d19c4393e1326c054dac7a4768a688100e76905c.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\ = "{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5a6aaa89814402ca4cff2cd1d19c4393e1326c054dac7a4768a688100e76905c.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\ = "{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\ = "Info cache" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ = "IIEHelperObj2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{295AB8C6-FB22-4D17-8834-064E2BA0A6F0}\TypeLib\ = "{285AB8C5-FB22-4D17-8834-064E2BA0A6F0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ = "IIEHelperObj2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}\ProxyStubClsid32 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4868 wrote to memory of 4892 4868 regsvr32.exe 81 PID 4868 wrote to memory of 4892 4868 regsvr32.exe 81 PID 4868 wrote to memory of 4892 4868 regsvr32.exe 81
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5a6aaa89814402ca4cff2cd1d19c4393e1326c054dac7a4768a688100e76905c.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5a6aaa89814402ca4cff2cd1d19c4393e1326c054dac7a4768a688100e76905c.dll2⤵
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- Modifies registry class
PID:4892
-