Analysis
-
max time kernel
43s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 14:11
Static task
static1
Behavioral task
behavioral1
Sample
96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
Resource
win10v2004-20221111-en
General
-
Target
96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe
-
Size
689KB
-
MD5
7dc5aa5df69332dd9156dc3c1c952bf0
-
SHA1
4e633c5e717e614f3239bc93baa29b94f3ebc157
-
SHA256
96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854
-
SHA512
6559eac2b653db3ea04340da0ff53b8a2b992a41146890aff9fc82caa6c7221e7394e8f21d7d493d8253058c05472e1bac41b49a02a16c37ed4a3236f297ea2b
-
SSDEEP
12288:JV4iR/0S3d830DBXG4G4Y7jeKuVnvon+N83LwwiAn6KkM33nxDmjeKuVOvjr+N8/:JVP0Edc01XG4G37tUnvone83Z76bMHx8
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha4048\\ie\\TrustMediaViewerV1alpha4048x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Loads dropped DLL 5 IoCs
Processes:
96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exeregsvr32.exeregsvr32.exeregsvr32.exepid process 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe 1520 regsvr32.exe 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe 844 regsvr32.exe 1316 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 6 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exeregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\ = "TrustMediaViewerV1alpha4048" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\NoExplorer = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\ = "TrustMediaViewerV1alpha4048" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\NoExplorer = "1" regsvr32.exe -
Drops file in System32 directory 4 IoCs
Processes:
96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe -
Drops file in Program Files directory 23 IoCs
Processes:
96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exedescription ioc process File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048.dll 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\install.rdf 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\ffTrustMediaViewerV1alpha4048ffaction.js 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\icons\default 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ch\TrustMediaViewerV1alpha4048.crx 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\ffTrustMediaViewerV1alpha4048.js 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\icons\Thumbs.db 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\icons\default\TrustMediaViewerV1alpha4048_32.png 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048x64.dll 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\ffTrustMediaViewerV1alpha4048ffaction.js 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\overlay.xul 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\icons\Thumbs.db 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\icons\default\TrustMediaViewerV1alpha4048_32.png 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ch\TrustMediaViewerV1alpha4048.crx 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome.manifest 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome.manifest 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\install.rdf 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\ffTrustMediaViewerV1alpha4048.js 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\overlay.xul 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ff\chrome\content\icons 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\uninstall.exe 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Approved Extensions 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25} = 51667a6c4c1d3b1b280b1c0fe556940986b8522b5cd8cb3c 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe -
Modifies registry class 56 IoCs
Processes:
regsvr32.exeregsvr32.exe96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\0\win64 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\ = "Trust Media Viewer" 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Version\ = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25} 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\ = "TrustMediaViewerV1alpha4048" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\ = "ITrustMediaViewerV1alpha4048BHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\0\win64\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha4048\\ie\\TrustMediaViewerV1alpha4048x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha4048\\ie\\TrustMediaViewerV1alpha4048.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\ = "ITrustMediaViewerV1alpha4048BHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\TypeLib\ = "{5D12E980-F317-46CA-AE7A-2787FF638E72}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\ = "TrustMediaViewerV1alpha4048Lib" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\HELPDIR\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha4048\\ie" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\TypeLib\Version = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\TypeLib\Version = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\TypeLib\ = "{5d12e980-f317-46ca-ae7a-2787ff638e72}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\0\win32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha4048\\ie\\TrustMediaViewerV1alpha4048.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\ = "TrustMediaViewerV1alpha4048" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\TypeLib\ = "{5d12e980-f317-46ca-ae7a-2787ff638e72}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Implemented Categories\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5D12E980-F317-46CA-AE7A-2787FF638E72}\1.1\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\TypeLib\ = "{5D12E980-F317-46CA-AE7A-2787FF638E72}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Version\ = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha4048\\ie\\TrustMediaViewerV1alpha4048x64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Implemented Categories\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2FA67B5E-AF65-453C-8AC0-CD78A4C9597D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f0c1738-0cd0-46fc-93b1-176b5e9c8e25}\TypeLib regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exepid process 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exeregsvr32.exedescription pid process target process PID 1956 wrote to memory of 1520 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe regsvr32.exe PID 1956 wrote to memory of 1520 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe regsvr32.exe PID 1956 wrote to memory of 1520 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe regsvr32.exe PID 1956 wrote to memory of 1520 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe regsvr32.exe PID 1956 wrote to memory of 1520 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe regsvr32.exe PID 1956 wrote to memory of 1520 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe regsvr32.exe PID 1956 wrote to memory of 1520 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe regsvr32.exe PID 1956 wrote to memory of 844 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe regsvr32.exe PID 1956 wrote to memory of 844 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe regsvr32.exe PID 1956 wrote to memory of 844 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe regsvr32.exe PID 1956 wrote to memory of 844 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe regsvr32.exe PID 1956 wrote to memory of 844 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe regsvr32.exe PID 1956 wrote to memory of 844 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe regsvr32.exe PID 1956 wrote to memory of 844 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe regsvr32.exe PID 844 wrote to memory of 1316 844 regsvr32.exe regsvr32.exe PID 844 wrote to memory of 1316 844 regsvr32.exe regsvr32.exe PID 844 wrote to memory of 1316 844 regsvr32.exe regsvr32.exe PID 844 wrote to memory of 1316 844 regsvr32.exe regsvr32.exe PID 844 wrote to memory of 1316 844 regsvr32.exe regsvr32.exe PID 844 wrote to memory of 1316 844 regsvr32.exe regsvr32.exe PID 844 wrote to memory of 1316 844 regsvr32.exe regsvr32.exe PID 1956 wrote to memory of 1608 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe gpupdate.exe PID 1956 wrote to memory of 1608 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe gpupdate.exe PID 1956 wrote to memory of 1608 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe gpupdate.exe PID 1956 wrote to memory of 1608 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe gpupdate.exe PID 1956 wrote to memory of 1608 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe gpupdate.exe PID 1956 wrote to memory of 1608 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe gpupdate.exe PID 1956 wrote to memory of 1608 1956 96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe gpupdate.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe"C:\Users\Admin\AppData\Local\Temp\96a86585524e5cea46904e5d60d5cd0d4a9fff32bf91cb11fa4cc681c60d7854.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048.dll" /s2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\System32\gpupdate.exe" /force2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048.dllFilesize
85KB
MD549aefbb4572739267b87a071cae7cb1b
SHA10263e6694e7ffa06a0eae5231ced364cda15e0e5
SHA25601d5bcc2e26d8cb361fff96daac6c6172ffece1a514b139a9543632c6d0a73a6
SHA512e5f74ab78c716bc2033c65ef21fadf61d2418b4db5a1e722ffc93d66e4efe23bd81d99250219c7ef0a48904ec6da27b4db5254f4e6f10773a418d53776f298c9
-
C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048x64.dllFilesize
100KB
MD55504d963ba44e928b38c2349c787ff39
SHA10c29bb0b5d83bf9062c8a6454153aa1ac261cc0b
SHA2562f36f3e23cf67e040368c2290a04d7417283f746570c4f08402d7bc7f25285be
SHA512483561294221b7110535880e6a59fef84ae3df4cadfdabd09c0d3f1c8cc26bd779f7e560c84d6ac675ecf77f1d2e44dbb7c44ad0c23e0f574b394add20fcb46c
-
\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048.dllFilesize
85KB
MD549aefbb4572739267b87a071cae7cb1b
SHA10263e6694e7ffa06a0eae5231ced364cda15e0e5
SHA25601d5bcc2e26d8cb361fff96daac6c6172ffece1a514b139a9543632c6d0a73a6
SHA512e5f74ab78c716bc2033c65ef21fadf61d2418b4db5a1e722ffc93d66e4efe23bd81d99250219c7ef0a48904ec6da27b4db5254f4e6f10773a418d53776f298c9
-
\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048x64.dllFilesize
100KB
MD55504d963ba44e928b38c2349c787ff39
SHA10c29bb0b5d83bf9062c8a6454153aa1ac261cc0b
SHA2562f36f3e23cf67e040368c2290a04d7417283f746570c4f08402d7bc7f25285be
SHA512483561294221b7110535880e6a59fef84ae3df4cadfdabd09c0d3f1c8cc26bd779f7e560c84d6ac675ecf77f1d2e44dbb7c44ad0c23e0f574b394add20fcb46c
-
\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha4048\ie\TrustMediaViewerV1alpha4048x64.dllFilesize
100KB
MD55504d963ba44e928b38c2349c787ff39
SHA10c29bb0b5d83bf9062c8a6454153aa1ac261cc0b
SHA2562f36f3e23cf67e040368c2290a04d7417283f746570c4f08402d7bc7f25285be
SHA512483561294221b7110535880e6a59fef84ae3df4cadfdabd09c0d3f1c8cc26bd779f7e560c84d6ac675ecf77f1d2e44dbb7c44ad0c23e0f574b394add20fcb46c
-
\Users\Admin\AppData\Local\Temp\nsyE217.tmp\System.dllFilesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
\Users\Admin\AppData\Local\Temp\nsyE217.tmp\aminsis.dllFilesize
567KB
MD5f346047b13f37f79c462e59a6319faa1
SHA1ce9e7cb9719000a69b463fe024c81229e322279f
SHA256e78e0e61707cabec8383f1e74da9db8e0fa123a3a7b36f0080d70fbaed6f7453
SHA512429209cc489ba9ac2d62055b128efb3cded3e31f966c7cdb1aee592ec7a54ab090526705fa2519498d92eb4bc2efa141cd83adc6c251b793388ad1208b172167
-
memory/844-61-0x0000000000000000-mapping.dmp
-
memory/1316-65-0x0000000000000000-mapping.dmp
-
memory/1316-66-0x000007FEFBF21000-0x000007FEFBF23000-memory.dmpFilesize
8KB
-
memory/1520-56-0x0000000000000000-mapping.dmp
-
memory/1608-68-0x0000000000000000-mapping.dmp
-
memory/1956-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB