Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 23:32
Behavioral task
behavioral1
Sample
76382b8e67abdc2cece5d7b166d38011d911b60fc3ebcca895e84bc0bdbcd641.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
General
-
Target
76382b8e67abdc2cece5d7b166d38011d911b60fc3ebcca895e84bc0bdbcd641.dll
-
Size
92KB
-
MD5
ed9f10a34be2bd1b9dcd2ef7d192abd1
-
SHA1
db578e01a142083439b179adf5f60a4ed8ea2984
-
SHA256
76382b8e67abdc2cece5d7b166d38011d911b60fc3ebcca895e84bc0bdbcd641
-
SHA512
71d25219e5c80ed6640a4449a1c2e9f43229017779198443b12cdb4f12af6920a15c21c7a6b4d203fca511c5debe831df841d0e6a1f1a21a7a38603aa2140e85
-
SSDEEP
1536:kG0veeOFJDn/Vsx10GiGVRHgGnzGycsrxiHLzExAE/LAAoAQR5T+0E2fvYr:kGQNOPLtsf0GHRHgVnLHU1/LAJP+n2fI
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1336-133-0x00000000755A0000-0x00000000755E0000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AAC4596E-DBAB-091B-2D7B-5B25D8B2DA3B} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AAC4596E-DBAB-091B-2D7B-5B25D8B2DA3B}\NoExplorer = "1" regsvr32.exe -
Modifies registry class 5 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AAC4596E-DBAB-091B-2D7B-5B25D8B2DA3B}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AAC4596E-DBAB-091B-2D7B-5B25D8B2DA3B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AAC4596E-DBAB-091B-2D7B-5B25D8B2DA3B}\ = "ThnuderAtDown Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AAC4596E-DBAB-091B-2D7B-5B25D8B2DA3B}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AAC4596E-DBAB-091B-2D7B-5B25D8B2DA3B}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\76382b8e67abdc2cece5d7b166d38011d911b60fc3ebcca895e84bc0bdbcd641.dll" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1264 wrote to memory of 1336 1264 regsvr32.exe regsvr32.exe PID 1264 wrote to memory of 1336 1264 regsvr32.exe regsvr32.exe PID 1264 wrote to memory of 1336 1264 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\76382b8e67abdc2cece5d7b166d38011d911b60fc3ebcca895e84bc0bdbcd641.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\76382b8e67abdc2cece5d7b166d38011d911b60fc3ebcca895e84bc0bdbcd641.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class