6bf775a0cf970c862b30cdb7f35b19fdb8cbc68a7af1f168f69ee798a46b47b5

Analysis

max time kernel
150s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bf775a0cf970c862b30cdb7f35b19fdb8cbc68a7af1f168f69ee798a46b47b5.exe
Size

45KB
MD5

130e596ea314a034bc42e47f8c4b3f20
SHA1

f6547697e04c4b6b59648a071cfdc795473ee1d2
SHA256

6bf775a0cf970c862b30cdb7f35b19fdb8cbc68a7af1f168f69ee798a46b47b5
SHA512

2b1451382e151cc0eaf1dbc3ec87f48d3212e1da8977f2a2faef4dd897522218c8da1383ebb510d9206e35d0b09281b10aab42251fbd8213c7b7c3c1a77678e7
SSDEEP

768:SQ+J6XKm4YVuQP9z2R8YKhClvcKuJKqyLohZOz+C:KIf4YV1FaSHbJKqO1z+C

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1988	regsvr32.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}	6bf775a0cf970c862b30cdb7f35b19fdb8cbc68a7af1f168f69ee798a46b47b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}\StubPath = "C:\\Windows\\system32\\OLE32Init.exe"	6bf775a0cf970c862b30cdb7f35b19fdb8cbc68a7af1f168f69ee798a46b47b5.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}\StubPath = "C:\\Windows\\system32\\OLE32Init.exe"	regsvr32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\OLE32Init.exe	6bf775a0cf970c862b30cdb7f35b19fdb8cbc68a7af1f168f69ee798a46b47b5.exe
File created	C:\Windows\SysWOW64\OLE32Init.exe	6bf775a0cf970c862b30cdb7f35b19fdb8cbc68a7af1f168f69ee798a46b47b5.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\regsvr32.exe	6bf775a0cf970c862b30cdb7f35b19fdb8cbc68a7af1f168f69ee798a46b47b5.exe
File created	C:\Windows\regsvr32.exe	6bf775a0cf970c862b30cdb7f35b19fdb8cbc68a7af1f168f69ee798a46b47b5.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1988	regsvr32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1988	1880	6bf775a0cf970c862b30cdb7f35b19fdb8cbc68a7af1f168f69ee798a46b47b5.exe	27
PID 1880 wrote to memory of 1988	1880	6bf775a0cf970c862b30cdb7f35b19fdb8cbc68a7af1f168f69ee798a46b47b5.exe	27
PID 1880 wrote to memory of 1988	1880	6bf775a0cf970c862b30cdb7f35b19fdb8cbc68a7af1f168f69ee798a46b47b5.exe	27
PID 1880 wrote to memory of 1988	1880	6bf775a0cf970c862b30cdb7f35b19fdb8cbc68a7af1f168f69ee798a46b47b5.exe	27

C:\Users\Admin\AppData\Local\Temp\6bf775a0cf970c862b30cdb7f35b19fdb8cbc68a7af1f168f69ee798a46b47b5.exe
"C:\Users\Admin\AppData\Local\Temp\6bf775a0cf970c862b30cdb7f35b19fdb8cbc68a7af1f168f69ee798a46b47b5.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\regsvr32.exe
  C:\Windows\regsvr32.exe
  2⤵
  - Executes dropped EXE
  - Modifies Installed Components in the registry
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\OLE32Init.exe

Filesize
45KB

MD5
c017a31a8e1efbaec2bab0110bc67c94

SHA1
cd7aad1534c515ea144119234423be42977457d3

SHA256
d659373aecd005ec768739bd9612dfb90ea2cf3352344deb88ec3dd4d1151d68

SHA512
df7c587820604ce11f875f8b1e73785e0dd63c843aba6665583525d92ebdef3cec9c908df2068e04f77553e7b8cc0ef60fb5458d69dc60323111ca33999bb820

Download Submit
C:\Windows\regsvr32.exe

Filesize
45KB

MD5
c017a31a8e1efbaec2bab0110bc67c94

SHA1
cd7aad1534c515ea144119234423be42977457d3

SHA256
d659373aecd005ec768739bd9612dfb90ea2cf3352344deb88ec3dd4d1151d68

SHA512
df7c587820604ce11f875f8b1e73785e0dd63c843aba6665583525d92ebdef3cec9c908df2068e04f77553e7b8cc0ef60fb5458d69dc60323111ca33999bb820

Download Submit
C:\Windows\regsvr32.exe

Filesize
45KB

MD5
c017a31a8e1efbaec2bab0110bc67c94

SHA1
cd7aad1534c515ea144119234423be42977457d3

SHA256
d659373aecd005ec768739bd9612dfb90ea2cf3352344deb88ec3dd4d1151d68

SHA512
df7c587820604ce11f875f8b1e73785e0dd63c843aba6665583525d92ebdef3cec9c908df2068e04f77553e7b8cc0ef60fb5458d69dc60323111ca33999bb820

Download Submit
memory/1880-54-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1880-55-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1880-58-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1988-62-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download