Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 05:48
Static task
static1
Behavioral task
behavioral1
Sample
8b6026bb078a4b98a6b10adf6e2b93b3e301db09eca6307fc3ec1b1c15d9b16b.dll
Resource
win7-20220901-en
windows7-x64
3 signatures
150 seconds
General
-
Target
8b6026bb078a4b98a6b10adf6e2b93b3e301db09eca6307fc3ec1b1c15d9b16b.dll
-
Size
144KB
-
MD5
65f644d13f0a8d55b1150bf8ca2a7435
-
SHA1
f4ea60dadc3e083741de225527035b4d83293c1f
-
SHA256
8b6026bb078a4b98a6b10adf6e2b93b3e301db09eca6307fc3ec1b1c15d9b16b
-
SHA512
f11127e13c5db2968c5fd0d46936be244981a8155dc858d5f146c8c3bee8a7e6ea0ae7857d417205a9d0e8084b0ad9b71df2e5ab193c71a7616cab710f86f468
-
SSDEEP
1536:iLsDsXdkGh3sEKGX2zjCsFcdikkV/+tVhle/9XkzDaCpfOAdbpIEBUH5llZ7nqDR:vDEdks3sEfVikbL7VvUHj7n/5etPT
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2}\NoExplorer regsvr32.exe -
Modifies registry class 5 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2}\ = "Gaming support for ArcadeWeb" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8b6026bb078a4b98a6b10adf6e2b93b3e301db09eca6307fc3ec1b1c15d9b16b.dll" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1632 wrote to memory of 1124 1632 regsvr32.exe regsvr32.exe PID 1632 wrote to memory of 1124 1632 regsvr32.exe regsvr32.exe PID 1632 wrote to memory of 1124 1632 regsvr32.exe regsvr32.exe PID 1632 wrote to memory of 1124 1632 regsvr32.exe regsvr32.exe PID 1632 wrote to memory of 1124 1632 regsvr32.exe regsvr32.exe PID 1632 wrote to memory of 1124 1632 regsvr32.exe regsvr32.exe PID 1632 wrote to memory of 1124 1632 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8b6026bb078a4b98a6b10adf6e2b93b3e301db09eca6307fc3ec1b1c15d9b16b.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\8b6026bb078a4b98a6b10adf6e2b93b3e301db09eca6307fc3ec1b1c15d9b16b.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class