Analysis
-
max time kernel
238s -
max time network
301s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 05:48
Static task
static1
Behavioral task
behavioral1
Sample
8b6026bb078a4b98a6b10adf6e2b93b3e301db09eca6307fc3ec1b1c15d9b16b.dll
Resource
win7-20220901-en
windows7-x64
3 signatures
150 seconds
General
-
Target
8b6026bb078a4b98a6b10adf6e2b93b3e301db09eca6307fc3ec1b1c15d9b16b.dll
-
Size
144KB
-
MD5
65f644d13f0a8d55b1150bf8ca2a7435
-
SHA1
f4ea60dadc3e083741de225527035b4d83293c1f
-
SHA256
8b6026bb078a4b98a6b10adf6e2b93b3e301db09eca6307fc3ec1b1c15d9b16b
-
SHA512
f11127e13c5db2968c5fd0d46936be244981a8155dc858d5f146c8c3bee8a7e6ea0ae7857d417205a9d0e8084b0ad9b71df2e5ab193c71a7616cab710f86f468
-
SSDEEP
1536:iLsDsXdkGh3sEKGX2zjCsFcdikkV/+tVhle/9XkzDaCpfOAdbpIEBUH5llZ7nqDR:vDEdks3sEfVikbL7VvUHj7n/5etPT
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2}\NoExplorer regsvr32.exe -
Modifies registry class 5 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2}\ = "Gaming support for ArcadeWeb" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8b6026bb078a4b98a6b10adf6e2b93b3e301db09eca6307fc3ec1b1c15d9b16b.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F531FB1-7C1F-4E1A-8C0C-E8D6177130E2}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4736 wrote to memory of 4128 4736 regsvr32.exe regsvr32.exe PID 4736 wrote to memory of 4128 4736 regsvr32.exe regsvr32.exe PID 4736 wrote to memory of 4128 4736 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8b6026bb078a4b98a6b10adf6e2b93b3e301db09eca6307fc3ec1b1c15d9b16b.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\8b6026bb078a4b98a6b10adf6e2b93b3e301db09eca6307fc3ec1b1c15d9b16b.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4128-132-0x0000000000000000-mapping.dmp