Analysis
-
max time kernel
45s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 13:44
Static task
static1
Behavioral task
behavioral1
Sample
ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe
Resource
win10v2004-20220812-en
General
-
Target
ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe
-
Size
689KB
-
MD5
ba87ab0cc90d6895f3952987c2eb8a85
-
SHA1
027751bb9e9a42960c86dd09cd1333a95ea5d538
-
SHA256
ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925
-
SHA512
9750565d67241388fbba63f6412ec7276e7233711fed03713fe1d67b0693b04aee0cd6211ff8b597ca710b3f7b48e292dafb2888b95694b7e955aa985a2491c8
-
SSDEEP
12288:oC3XHygb5fVdsbkG4G4Y7jeKuVnvon+N83LwwiAn6KkM33nxD3jeKuVGv/9+N8Oe:o63yW5fVdHG4G37tUnvone83Z76bMHxN
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha4601\\ie\\TrustMediaViewerV1alpha4601x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Loads dropped DLL 5 IoCs
Processes:
ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exeregsvr32.exeregsvr32.exeregsvr32.exepid process 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe 912 regsvr32.exe 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe 1736 regsvr32.exe 1356 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 6 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exeregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{183276ed-2d9c-493c-aa3f-764861396e48} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{183276ed-2d9c-493c-aa3f-764861396e48}\ = "TrustMediaViewerV1alpha4601" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{183276ed-2d9c-493c-aa3f-764861396e48}\NoExplorer = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{183276ed-2d9c-493c-aa3f-764861396e48} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{183276ed-2d9c-493c-aa3f-764861396e48}\ = "TrustMediaViewerV1alpha4601" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{183276ed-2d9c-493c-aa3f-764861396e48}\NoExplorer = "1" regsvr32.exe -
Drops file in System32 directory 4 IoCs
Processes:
ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe -
Drops file in Program Files directory 23 IoCs
Processes:
ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exedescription ioc process File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ff\chrome\content\icons\default ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ch\TrustMediaViewerV1alpha4601.crx ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ch\TrustMediaViewerV1alpha4601.crx ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ff\chrome\content\ffTrustMediaViewerV1alpha4601.js ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ff\chrome\content\ffTrustMediaViewerV1alpha4601.js ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ff\chrome\content\ffTrustMediaViewerV1alpha4601ffaction.js ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ff\chrome\content\icons\Thumbs.db ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ff\chrome\content\icons\Thumbs.db ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\uninstall.exe ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ie\TrustMediaViewerV1alpha4601.dll ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ff\chrome.manifest ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ff\install.rdf ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ff\install.rdf ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ff\chrome\content\ffTrustMediaViewerV1alpha4601ffaction.js ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ff\chrome\content\overlay.xul ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ff\chrome\content\icons ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ie\TrustMediaViewerV1alpha4601x64.dll ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ff\chrome.manifest ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ff\chrome\content ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ff\chrome\content\icons\default\TrustMediaViewerV1alpha4601_32.png ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ff\chrome ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ff\chrome\content\overlay.xul ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ff\chrome\content\icons\default\TrustMediaViewerV1alpha4601_32.png ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Approved Extensions ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{183276ed-2d9c-493c-aa3f-764861396e48} = 51667a6c4c1d3b1bfd6a2208a9775406bf363308637d2b51 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe -
Modifies registry class 56 IoCs
Processes:
regsvr32.exeregsvr32.exece25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B9386B92-893F-48FF-B0FE-24EFAEA0067B}\1.1\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{70C8A5C5-112C-476B-9A4C-2BDBCB8A571F}\TypeLib\Version = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\ = "TrustMediaViewerV1alpha4601" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\TypeLib\ = "{b9386b92-893f-48ff-b0fe-24efaea0067b}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\ = "TrustMediaViewerV1alpha4601" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B9386B92-893F-48FF-B0FE-24EFAEA0067B}\1.1\0\win32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha4601\\ie\\TrustMediaViewerV1alpha4601.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{70C8A5C5-112C-476B-9A4C-2BDBCB8A571F}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{70C8A5C5-112C-476B-9A4C-2BDBCB8A571F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha4601\\ie\\TrustMediaViewerV1alpha4601x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B9386B92-893F-48FF-B0FE-24EFAEA0067B}\1.1\0\win64\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha4601\\ie\\TrustMediaViewerV1alpha4601x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70C8A5C5-112C-476B-9A4C-2BDBCB8A571F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B9386B92-893F-48FF-B0FE-24EFAEA0067B}\1.1\HELPDIR\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha4601\\ie" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B9386B92-893F-48FF-B0FE-24EFAEA0067B}\1.1\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\Version\ = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B9386B92-893F-48FF-B0FE-24EFAEA0067B}\1.1\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B9386B92-893F-48FF-B0FE-24EFAEA0067B}\1.1\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{70C8A5C5-112C-476B-9A4C-2BDBCB8A571F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70C8A5C5-112C-476B-9A4C-2BDBCB8A571F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B9386B92-893F-48FF-B0FE-24EFAEA0067B}\1.1\ = "TrustMediaViewerV1alpha4601Lib" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{70C8A5C5-112C-476B-9A4C-2BDBCB8A571F}\ = "ITrustMediaViewerV1alpha4601BHO" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70C8A5C5-112C-476B-9A4C-2BDBCB8A571F}\ = "ITrustMediaViewerV1alpha4601BHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70C8A5C5-112C-476B-9A4C-2BDBCB8A571F}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70C8A5C5-112C-476B-9A4C-2BDBCB8A571F}\TypeLib\Version = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48} ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70C8A5C5-112C-476B-9A4C-2BDBCB8A571F}\TypeLib\ = "{B9386B92-893F-48FF-B0FE-24EFAEA0067B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B9386B92-893F-48FF-B0FE-24EFAEA0067B}\1.1\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\Implemented Categories\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\TypeLib\ = "{b9386b92-893f-48ff-b0fe-24efaea0067b}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\Version\ = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha4601\\ie\\TrustMediaViewerV1alpha4601.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B9386B92-893F-48FF-B0FE-24EFAEA0067B}\1.1\0\win64 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B9386B92-893F-48FF-B0FE-24EFAEA0067B}\1.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{70C8A5C5-112C-476B-9A4C-2BDBCB8A571F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{70C8A5C5-112C-476B-9A4C-2BDBCB8A571F}\TypeLib\ = "{B9386B92-893F-48FF-B0FE-24EFAEA0067B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\Implemented Categories\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\ = "Trust Media Viewer" ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B9386B92-893F-48FF-B0FE-24EFAEA0067B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70C8A5C5-112C-476B-9A4C-2BDBCB8A571F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{183276ed-2d9c-493c-aa3f-764861396e48}\Programmable regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exepid process 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exeregsvr32.exedescription pid process target process PID 536 wrote to memory of 912 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe regsvr32.exe PID 536 wrote to memory of 912 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe regsvr32.exe PID 536 wrote to memory of 912 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe regsvr32.exe PID 536 wrote to memory of 912 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe regsvr32.exe PID 536 wrote to memory of 912 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe regsvr32.exe PID 536 wrote to memory of 912 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe regsvr32.exe PID 536 wrote to memory of 912 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe regsvr32.exe PID 536 wrote to memory of 1736 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe regsvr32.exe PID 536 wrote to memory of 1736 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe regsvr32.exe PID 536 wrote to memory of 1736 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe regsvr32.exe PID 536 wrote to memory of 1736 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe regsvr32.exe PID 536 wrote to memory of 1736 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe regsvr32.exe PID 536 wrote to memory of 1736 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe regsvr32.exe PID 536 wrote to memory of 1736 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe regsvr32.exe PID 1736 wrote to memory of 1356 1736 regsvr32.exe regsvr32.exe PID 1736 wrote to memory of 1356 1736 regsvr32.exe regsvr32.exe PID 1736 wrote to memory of 1356 1736 regsvr32.exe regsvr32.exe PID 1736 wrote to memory of 1356 1736 regsvr32.exe regsvr32.exe PID 1736 wrote to memory of 1356 1736 regsvr32.exe regsvr32.exe PID 1736 wrote to memory of 1356 1736 regsvr32.exe regsvr32.exe PID 1736 wrote to memory of 1356 1736 regsvr32.exe regsvr32.exe PID 536 wrote to memory of 2036 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe gpupdate.exe PID 536 wrote to memory of 2036 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe gpupdate.exe PID 536 wrote to memory of 2036 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe gpupdate.exe PID 536 wrote to memory of 2036 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe gpupdate.exe PID 536 wrote to memory of 2036 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe gpupdate.exe PID 536 wrote to memory of 2036 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe gpupdate.exe PID 536 wrote to memory of 2036 536 ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe gpupdate.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe"C:\Users\Admin\AppData\Local\Temp\ce25d12e8a646343cb0067adf988cc55053c59c92b04515c500f5ebe5500d925.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ie\TrustMediaViewerV1alpha4601.dll" /s2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ie\TrustMediaViewerV1alpha4601x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ie\TrustMediaViewerV1alpha4601x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\System32\gpupdate.exe" /force2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ie\TrustMediaViewerV1alpha4601.dllFilesize
85KB
MD5dbd8f0b49d5f216097c9b0d04a963eef
SHA14ff1cbf6b6a9709208daf9156bdb9eb364dbd594
SHA2563c601edddf1113b296bf50c0e41226e0e31dea80f790375fa5e75cc5e526172a
SHA512cbd9f4ee75d727019d178d734b3888234f56829d2320f15b4fe10565e66726fc0c1ea25af56f70fd97c185277ca2690f107dfee0499f8d486f4696ff9c93dda3
-
C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ie\TrustMediaViewerV1alpha4601x64.dllFilesize
100KB
MD5e7ae85e323093a23d04403d93694dac4
SHA1923cdc2e49a59c9ae1f2d2ce35b605bcd9bd59af
SHA256447736dfe55270fb70530606107d70fcd88423e6a0ccbfd17e26e60d46bbb6f3
SHA512178dc0fbcc5d38aa35576e0c179399335cc9b596f35d9661ddd0f7671e6951d8482137459b290b16d4b278ff11e313f1f6071347bde4ef30a733e634b4ae5695
-
\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ie\TrustMediaViewerV1alpha4601.dllFilesize
85KB
MD5dbd8f0b49d5f216097c9b0d04a963eef
SHA14ff1cbf6b6a9709208daf9156bdb9eb364dbd594
SHA2563c601edddf1113b296bf50c0e41226e0e31dea80f790375fa5e75cc5e526172a
SHA512cbd9f4ee75d727019d178d734b3888234f56829d2320f15b4fe10565e66726fc0c1ea25af56f70fd97c185277ca2690f107dfee0499f8d486f4696ff9c93dda3
-
\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ie\TrustMediaViewerV1alpha4601x64.dllFilesize
100KB
MD5e7ae85e323093a23d04403d93694dac4
SHA1923cdc2e49a59c9ae1f2d2ce35b605bcd9bd59af
SHA256447736dfe55270fb70530606107d70fcd88423e6a0ccbfd17e26e60d46bbb6f3
SHA512178dc0fbcc5d38aa35576e0c179399335cc9b596f35d9661ddd0f7671e6951d8482137459b290b16d4b278ff11e313f1f6071347bde4ef30a733e634b4ae5695
-
\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4601\ie\TrustMediaViewerV1alpha4601x64.dllFilesize
100KB
MD5e7ae85e323093a23d04403d93694dac4
SHA1923cdc2e49a59c9ae1f2d2ce35b605bcd9bd59af
SHA256447736dfe55270fb70530606107d70fcd88423e6a0ccbfd17e26e60d46bbb6f3
SHA512178dc0fbcc5d38aa35576e0c179399335cc9b596f35d9661ddd0f7671e6951d8482137459b290b16d4b278ff11e313f1f6071347bde4ef30a733e634b4ae5695
-
\Users\Admin\AppData\Local\Temp\nstE1AA.tmp\System.dllFilesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
\Users\Admin\AppData\Local\Temp\nstE1AA.tmp\aminsis.dllFilesize
567KB
MD5f346047b13f37f79c462e59a6319faa1
SHA1ce9e7cb9719000a69b463fe024c81229e322279f
SHA256e78e0e61707cabec8383f1e74da9db8e0fa123a3a7b36f0080d70fbaed6f7453
SHA512429209cc489ba9ac2d62055b128efb3cded3e31f966c7cdb1aee592ec7a54ab090526705fa2519498d92eb4bc2efa141cd83adc6c251b793388ad1208b172167
-
memory/536-54-0x0000000075B11000-0x0000000075B13000-memory.dmpFilesize
8KB
-
memory/912-56-0x0000000000000000-mapping.dmp
-
memory/1356-65-0x0000000000000000-mapping.dmp
-
memory/1356-66-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmpFilesize
8KB
-
memory/1736-61-0x0000000000000000-mapping.dmp
-
memory/2036-68-0x0000000000000000-mapping.dmp