Analysis
-
max time kernel
116s -
max time network
183s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
31-10-2022 00:23
Static task
static1
Behavioral task
behavioral1
Sample
f4c18aff463ce4a5268fad52ff41ccefb68dc3bef31bdfecc0016fa522135fa8.dll
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
f4c18aff463ce4a5268fad52ff41ccefb68dc3bef31bdfecc0016fa522135fa8.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
f4c18aff463ce4a5268fad52ff41ccefb68dc3bef31bdfecc0016fa522135fa8.dll
-
Size
475KB
-
MD5
90ed8a1586dd00867e710aa3298d3e8b
-
SHA1
0a0311c190144d8c73bc2428b6eb0cf31234ac7b
-
SHA256
f4c18aff463ce4a5268fad52ff41ccefb68dc3bef31bdfecc0016fa522135fa8
-
SHA512
ba9495f490ba895222fb9be07672efcd7f20cc906d93c9ee8b829520f58a86b162f3e75b2e459c200ca4dc7785ecece60209d0723250dd34e05d7609d2c330e7
-
SSDEEP
12288:OTLUn/s4D5WVr8WkQUW7ccIZsmf586NSQth:OTLU/LD5W1/U4a5B8oSQt
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gpdhubgofgxeuziq = "C:\\Windows\\System32\\regsvr32.exe /s \"C:\\Users\\Admin\\AppData\\Local\\Temp\\f4c18aff463ce4a5268fad52ff41ccefb68dc3bef31bdfecc0016fa522135fa8.dll\"" regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CAFE5182-A5F7-EEE8-58BF-B87AF9191F80} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{CAFE5182-A5F7-EEE8-58BF-B87AF9191F80}\NoExplorer = "1" regsvr32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f2c4b368edd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374013604" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf000000000200000000001066000000010000200000006894a5e01abf055effc8fe4f9166f653a683d76bfb452ebd8f60bdf9b97f57d0000000000e8000000002000020000000e1a6f47eec808745c8017238cb4ae30ebadc5f072ed21383fb4182213718e1b3200000008ecb6a40b64ebe9a1ec2b4d1d8b6e876b54aea0756ac766d5542500ffc68c1474000000054ad5778a2475732f7edc9b2709e58abc9cb44365c141ca2f1bf562500069fbdf78bfeeca6e984388436fdbaacbf94ee19383fe4d29fc691a8de94e7c71890fe iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C5466B81-595B-11ED-A6C3-FE72C9E2D9C9} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf0000000002000000000010660000000100002000000089cccc43bebffdab39678045536bed4be617d3f7739ce91fd59dc56733fa03f5000000000e80000000020000200000005fcf0893d2ad641ca8d4f5b4a717bf0aaf177d52ff655c0c07e0fadc8802f442900000003b8e34c9acff5051cbfadd4acb0fa90217640deda584ad247ece88a358787cf5c0a985f118d0f6923200cd261e863fe3ed470af65ce83c3497490f4d56d6c2c131a8e7cef58c629b4663021955e2b9a4970426b682440f601c4161674a67fbba362876f319124cd0e7207b3b7bb65708336a1931fcaa582224cc20507ae649744db8b853b9dc1f03ffdc9f765e9a046e400000009e29bbded0f2070dd8d9073991db6e531578341b756f9cfcc58a8c89d92ae95ad956620508102d7a3f3130ab53d24e0e70364c8c02182d2016e3e2641d8fc503 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFE5182-A5F7-EEE8-58BF-B87AF9191F80}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFE5182-A5F7-EEE8-58BF-B87AF9191F80}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f4c18aff463ce4a5268fad52ff41ccefb68dc3bef31bdfecc0016fa522135fa8.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFE5182-A5F7-EEE8-58BF-B87AF9191F80} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFE5182-A5F7-EEE8-58BF-B87AF9191F80}\ = "snappyads browser enhancer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFE5182-A5F7-EEE8-58BF-B87AF9191F80}\InProcServer32 regsvr32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1216 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1216 iexplore.exe 1216 iexplore.exe 1796 IEXPLORE.EXE 1796 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 996 wrote to memory of 1704 996 regsvr32.exe 27 PID 996 wrote to memory of 1704 996 regsvr32.exe 27 PID 996 wrote to memory of 1704 996 regsvr32.exe 27 PID 996 wrote to memory of 1704 996 regsvr32.exe 27 PID 996 wrote to memory of 1704 996 regsvr32.exe 27 PID 996 wrote to memory of 1704 996 regsvr32.exe 27 PID 996 wrote to memory of 1704 996 regsvr32.exe 27 PID 1216 wrote to memory of 1796 1216 iexplore.exe 30 PID 1216 wrote to memory of 1796 1216 iexplore.exe 30 PID 1216 wrote to memory of 1796 1216 iexplore.exe 30 PID 1216 wrote to memory of 1796 1216 iexplore.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f4c18aff463ce4a5268fad52ff41ccefb68dc3bef31bdfecc0016fa522135fa8.dll1⤵
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\f4c18aff463ce4a5268fad52ff41ccefb68dc3bef31bdfecc0016fa522135fa8.dll2⤵
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1704
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1216 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1796
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD59f42dc2b0a213506953d2cf40e234a54
SHA174f4793ee9ad17166b0c3cce6e8c2c77189ecd70
SHA256c3da81356202520164e3608393379b2db58ce728932966743fe18a96699d7f94
SHA5124d76478c4c053ec8e64ed5029b3d9a95999e99d4aa120244bddeff417e85dec6cb3f7f0216fc8737d69800652dd72a917f26633160eeadaa5d0e09fae390366c