Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 05:32
Static task
static1
Behavioral task
behavioral1
Sample
8fdea66452c8038e45e6e80c8460862c9100a31d4d3aec7b70c52f51126d804c.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
General
-
Target
8fdea66452c8038e45e6e80c8460862c9100a31d4d3aec7b70c52f51126d804c.dll
-
Size
144KB
-
MD5
53bf35ac1b476d6c13b5bfdbadb46213
-
SHA1
5cd3492fe5447bea357c360ecf12a5521867f547
-
SHA256
8fdea66452c8038e45e6e80c8460862c9100a31d4d3aec7b70c52f51126d804c
-
SHA512
aef7fddbd5874c76f5fccf35545599d3e1ff5d5e8d7ab94b1f15f85f919fe6563392d58c23deb55d1720fa201a872b2a960ef287b9d412f049df7a55f7b75b1f
-
SSDEEP
1536:4LsDsXdkGh3sEKGX2zjCsFcdikkV/+tVhle/9XkzDaCpfOAdbpIEBUH5elZ7nqDR:VDEdks3sEfVikbL7VvUHs7n/5etPT
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2}\NoExplorer regsvr32.exe -
Modifies registry class 5 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8fdea66452c8038e45e6e80c8460862c9100a31d4d3aec7b70c52f51126d804c.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2}\ = "Gaming support for ArcadeWeb" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1480 wrote to memory of 1628 1480 regsvr32.exe regsvr32.exe PID 1480 wrote to memory of 1628 1480 regsvr32.exe regsvr32.exe PID 1480 wrote to memory of 1628 1480 regsvr32.exe regsvr32.exe PID 1480 wrote to memory of 1628 1480 regsvr32.exe regsvr32.exe PID 1480 wrote to memory of 1628 1480 regsvr32.exe regsvr32.exe PID 1480 wrote to memory of 1628 1480 regsvr32.exe regsvr32.exe PID 1480 wrote to memory of 1628 1480 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8fdea66452c8038e45e6e80c8460862c9100a31d4d3aec7b70c52f51126d804c.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\8fdea66452c8038e45e6e80c8460862c9100a31d4d3aec7b70c52f51126d804c.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class