Analysis
-
max time kernel
224s -
max time network
333s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 05:12
Behavioral task
behavioral1
Sample
d9211ff5636bce8a832e32d5c7a8b45ea5731e6581fc7b452e3b98eb0f3d3b3f.dll
Resource
win7-20221111-en
General
-
Target
d9211ff5636bce8a832e32d5c7a8b45ea5731e6581fc7b452e3b98eb0f3d3b3f.dll
-
Size
2.4MB
-
MD5
133bf51d031b101ac6f87f6e13c85d53
-
SHA1
6e09b96d9ab68d673a872d47efe0d2625c09e3da
-
SHA256
d9211ff5636bce8a832e32d5c7a8b45ea5731e6581fc7b452e3b98eb0f3d3b3f
-
SHA512
39e8d610605620bb78d85253af21021860086132ce963b9a53a5d4f41b2e4aafa89f5261bff779e4a165e1545656b9686a66e6e27478c8792ff2b044bff9f7d2
-
SSDEEP
24576:y3mIEaiSE7PEDjG6VVWiqFQypkI8KJaZi3kPTa3g9yEj7OD2AH6CPsW:ylwSE7PEDjG6TaQ9yo1AN
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
regsvr32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Wine regsvr32.exe -
Processes:
resource yara_rule behavioral1/memory/1344-57-0x0000000001F50000-0x000000000234C000-memory.dmp themida behavioral1/memory/1344-58-0x0000000001F50000-0x000000000234C000-memory.dmp themida behavioral1/memory/1344-59-0x0000000001F50000-0x000000000234C000-memory.dmp themida behavioral1/memory/1344-60-0x0000000001F50000-0x000000000234C000-memory.dmp themida -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{09AFB2CE-9837-CA3E-0CB1-0A0B00C83DF2} regsvr32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
regsvr32.exepid process 1344 regsvr32.exe -
Modifies registry class 11 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\d9211ff5636bce8a832e32d5c7a8b45ea5731e6581fc7b452e3b98eb0f3d3b3f.MS_Plugin_116 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09AFB2CE-9837-CA3E-0CB1-0A0B00C83DF2}\ = "MS_Plugin" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09AFB2CE-9837-CA3E-0CB1-0A0B00C83DF2}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09AFB2CE-9837-CA3E-0CB1-0A0B00C83DF2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d9211ff5636bce8a832e32d5c7a8b45ea5731e6581fc7b452e3b98eb0f3d3b3f.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\d9211ff5636bce8a832e32d5c7a8b45ea5731e6581fc7b452e3b98eb0f3d3b3f.MS_Plugin_116\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\d9211ff5636bce8a832e32d5c7a8b45ea5731e6581fc7b452e3b98eb0f3d3b3f.MS_Plugin_116\Clsid\ = "{09AFB2CE-9837-CA3E-0CB1-0A0B00C83DF2}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09AFB2CE-9837-CA3E-0CB1-0A0B00C83DF2}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09AFB2CE-9837-CA3E-0CB1-0A0B00C83DF2}\ProgID\ = "d9211ff5636bce8a832e32d5c7a8b45ea5731e6581fc7b452e3b98eb0f3d3b3f.MS_Plugin_116" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09AFB2CE-9837-CA3E-0CB1-0A0B00C83DF2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{09AFB2CE-9837-CA3E-0CB1-0A0B00C83DF2}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\d9211ff5636bce8a832e32d5c7a8b45ea5731e6581fc7b452e3b98eb0f3d3b3f.MS_Plugin_116\ = "MS_Plugin" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
regsvr32.exepid process 1344 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1172 wrote to memory of 1344 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 1344 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 1344 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 1344 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 1344 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 1344 1172 regsvr32.exe regsvr32.exe PID 1172 wrote to memory of 1344 1172 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\d9211ff5636bce8a832e32d5c7a8b45ea5731e6581fc7b452e3b98eb0f3d3b3f.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\d9211ff5636bce8a832e32d5c7a8b45ea5731e6581fc7b452e3b98eb0f3d3b3f.dll2⤵
- Identifies Wine through registry keys
- Installs/modifies Browser Helper Object
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1172-54-0x000007FEFB8A1000-0x000007FEFB8A3000-memory.dmpFilesize
8KB
-
memory/1344-55-0x0000000000000000-mapping.dmp
-
memory/1344-56-0x00000000757E1000-0x00000000757E3000-memory.dmpFilesize
8KB
-
memory/1344-57-0x0000000001F50000-0x000000000234C000-memory.dmpFilesize
4.0MB
-
memory/1344-58-0x0000000001F50000-0x000000000234C000-memory.dmpFilesize
4.0MB
-
memory/1344-59-0x0000000001F50000-0x000000000234C000-memory.dmpFilesize
4.0MB
-
memory/1344-60-0x0000000001F50000-0x000000000234C000-memory.dmpFilesize
4.0MB