Analysis

  • max time kernel
    90s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-11-2022 05:15

General

  • Target

    936ec582590f1b0fbe9b73ddf5ed1ae8036cd7f49d1cbf67218b3a77c06d0e52.dll

  • Size

    60KB

  • MD5

    8a62a7e5a153aca167d972af0279767e

  • SHA1

    e9be575e8fe482bd56b04e381fd7908ead42a993

  • SHA256

    936ec582590f1b0fbe9b73ddf5ed1ae8036cd7f49d1cbf67218b3a77c06d0e52

  • SHA512

    b33e64aac0d2d2fd18c16936a422ae36cb8d17fe3ff30f58f6ff882eb71ae91ad58915716e936c1e2b8a8560e092cb78db7c0be84f70684dafaa2c9f4f690f7f

  • SSDEEP

    1536:c2AK45Xs4eNoirgtNwsYoJ7ZZ45xgLaTk:c1mry7YonZ4YLaA

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\936ec582590f1b0fbe9b73ddf5ed1ae8036cd7f49d1cbf67218b3a77c06d0e52.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4844
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\936ec582590f1b0fbe9b73ddf5ed1ae8036cd7f49d1cbf67218b3a77c06d0e52.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies Internet Explorer settings
      • Modifies registry class
      PID:4812
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 896
        3⤵
        • Program crash
        PID:2700
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4812 -ip 4812
    1⤵
      PID:1644

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Browser Extensions

    1
    T1176

    Defense Evasion

    Modify Registry

    2
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4812-132-0x0000000000000000-mapping.dmp