Overview
overview
8Static
static
4Data/packa...64.dll
windows7-x64
8Data/packa...64.dll
windows10-2004-x64
8Data/packa...re.dll
windows7-x64
1Data/packa...re.dll
windows10-2004-x64
1Data/packa...ix.xml
windows7-x64
1Data/packa...ix.xml
windows10-2004-x64
1Data/packa...se.xml
windows7-x64
1Data/packa...se.xml
windows10-2004-x64
1Data/packa...80.xml
windows7-x64
1Data/packa...80.xml
windows10-2004-x64
1Data/packa...90.xml
windows7-x64
1Data/packa...90.xml
windows10-2004-x64
1Data/packa...01.xml
windows7-x64
1Data/packa...01.xml
windows10-2004-x64
1Data/packa...ve.xml
windows7-x64
1Data/packa...ve.xml
windows10-2004-x64
1Data/packa...et.xml
windows7-x64
1Data/packa...et.xml
windows10-2004-x64
1Data/packa...l7.xml
windows7-x64
1Data/packa...l7.xml
windows10-2004-x64
1Data/packa...00.xml
windows7-x64
1Data/packa...00.xml
windows10-2004-x64
1Data/packa...70.xml
windows7-x64
1Data/packa...70.xml
windows10-2004-x64
1Data/packa...90.xml
windows7-x64
1Data/packa...90.xml
windows10-2004-x64
1Data/packa...dw.xml
windows7-x64
1Data/packa...dw.xml
windows10-2004-x64
1Data/packa...41.xml
windows7-x64
1Data/packa...41.xml
windows10-2004-x64
1Data/packa...rv.dll
windows7-x64
1Data/packa...rv.dll
windows10-2004-x64
1Analysis
-
max time kernel
133s -
max time network
626s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2022 16:41
Behavioral task
behavioral1
Sample
Data/package/Program Files (x86)/ASIO4ALL v2/asio4all64.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Data/package/Program Files (x86)/ASIO4ALL v2/asio4all64.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Data/package/Program Files (x86)/Common Files/Propellerhead Software/ReWire/ReWire.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
Data/package/Program Files (x86)/Common Files/Propellerhead Software/ReWire/ReWire.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/Informix.xml
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/Informix.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/Sybase.xml
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/Sybase.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/as80.xml
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/as80.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/as90.xml
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/as90.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/db2v0801.xml
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/db2v0801.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/hive.xml
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/hive.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/msjet.xml
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/msjet.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral19
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/orcl7.xml
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/orcl7.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql2000.xml
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql2000.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql70.xml
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql70.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral25
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql90.xml
Resource
win7-20220901-en
Behavioral task
behavioral26
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql90.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral27
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sqlpdw.xml
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sqlpdw.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/trdtv2r41.xml
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/trdtv2r41.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Resources/1049/msmdsrv.dll
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
Data/package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Resources/1049/msmdsrv.dll
Resource
win10v2004-20220812-en
General
-
Target
Data/package/Program Files (x86)/ASIO4ALL v2/asio4all64.dll
-
Size
142KB
-
MD5
74edb1ea4bee5a60a683b5bb801f3574
-
SHA1
55b62e45e7cf3e4b7255c1f3841c886394c8d851
-
SHA256
5564e99ce1d0ec73e762156af09e3d22bfec7af6f1bdcabe81e64825c7ca53da
-
SHA512
ff6b8ff3f7f68e2700591991a1b862b2c3311a349c27c0facd0a0277c6394e905162f0637ab48eaa94515af29700d2031838cdaf997f7d6c0d521e3a20114266
-
SSDEEP
1536:DbF0z8pabtCmKHCZm8d4vzi7YetKrZECd/dUgRqXxJkCVmkcu32h:vJ8d4m7YrZL/y1Wu32
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Data\\package\\Program Files (x86)\\ASIO4ALL v2\\asio4all64.dll" regsvr32.exe -
Modifies registry class 5 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\ = "ASIO4ALL v2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Data\\package\\Program Files (x86)\\ASIO4ALL v2\\asio4all64.dll" regsvr32.exe