Analysis
-
max time kernel
190s -
max time network
239s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 05:49
Static task
static1
Behavioral task
behavioral1
Sample
8b4f7bbcfd855e99cccad202b926fab923e4c2e8d92ea8121d30e5082392b4f6.exe
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
General
-
Target
8b4f7bbcfd855e99cccad202b926fab923e4c2e8d92ea8121d30e5082392b4f6.exe
-
Size
326KB
-
MD5
5205a2987f68feab36423aa8bb427dcb
-
SHA1
36eb7bfc23a5f40e027766acbba471678c2d7ec2
-
SHA256
8b4f7bbcfd855e99cccad202b926fab923e4c2e8d92ea8121d30e5082392b4f6
-
SHA512
25144049d6ea418fa29f36e8af1e82281c7af21c6f09b6f1d1d62881b01f6871e110c35de756bd403c9e2eeb7181a416ecdef946f3edd6af6358432fc824cbbd
-
SSDEEP
6144:cs9he7YCtLya0/gYkmdT6e2m2mqCyCy2OG+CvebsDsvqf9q2+r8FiFYwEKiI:5fTj//vXh9qr8IiI
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
8b4f7bbcfd855e99cccad202b926fab923e4c2e8d92ea8121d30e5082392b4f6.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486} 8b4f7bbcfd855e99cccad202b926fab923e4c2e8d92ea8121d30e5082392b4f6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}\NoExplorer = "1" 8b4f7bbcfd855e99cccad202b926fab923e4c2e8d92ea8121d30e5082392b4f6.exe -
Drops file in Program Files directory 1 IoCs
Processes:
8b4f7bbcfd855e99cccad202b926fab923e4c2e8d92ea8121d30e5082392b4f6.exedescription ioc process File created C:\Program Files (x86)\Shared\lib.dll 8b4f7bbcfd855e99cccad202b926fab923e4c2e8d92ea8121d30e5082392b4f6.exe -
Modifies registry class 7 IoCs
Processes:
8b4f7bbcfd855e99cccad202b926fab923e4c2e8d92ea8121d30e5082392b4f6.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}\TypeLib 8b4f7bbcfd855e99cccad202b926fab923e4c2e8d92ea8121d30e5082392b4f6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}\TypeLib\ = "{8E3C68CD-F500-4A2A-8CB9-132BB38C3573}" 8b4f7bbcfd855e99cccad202b926fab923e4c2e8d92ea8121d30e5082392b4f6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486} 8b4f7bbcfd855e99cccad202b926fab923e4c2e8d92ea8121d30e5082392b4f6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}\ = "Browser Helper Object" 8b4f7bbcfd855e99cccad202b926fab923e4c2e8d92ea8121d30e5082392b4f6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}\InprocServer32 8b4f7bbcfd855e99cccad202b926fab923e4c2e8d92ea8121d30e5082392b4f6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}\InprocServer32\ = "C:\\Program Files (x86)\\Shared\\lib.dll" 8b4f7bbcfd855e99cccad202b926fab923e4c2e8d92ea8121d30e5082392b4f6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFD4AD01-58C1-47DB-A404-FBE00A6C5486}\InprocServer32\ThreadingModel = "Apartment" 8b4f7bbcfd855e99cccad202b926fab923e4c2e8d92ea8121d30e5082392b4f6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b4f7bbcfd855e99cccad202b926fab923e4c2e8d92ea8121d30e5082392b4f6.exe"C:\Users\Admin\AppData\Local\Temp\8b4f7bbcfd855e99cccad202b926fab923e4c2e8d92ea8121d30e5082392b4f6.exe"1⤵
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies registry class