Analysis
-
max time kernel
151s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 05:52
Static task
static1
Behavioral task
behavioral1
Sample
8ae4ad07c788e6839e8c48bec49538b1a3dbb61ce44cad7ccdbc395480c45ea4.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8ae4ad07c788e6839e8c48bec49538b1a3dbb61ce44cad7ccdbc395480c45ea4.dll
Resource
win10v2004-20221111-en
General
-
Target
8ae4ad07c788e6839e8c48bec49538b1a3dbb61ce44cad7ccdbc395480c45ea4.dll
-
Size
192KB
-
MD5
da6dfd239fb6c22ffba3a3171d77a7f0
-
SHA1
f8decc8bbfb2fe6267c9d0f406f3d3ae5abef618
-
SHA256
8ae4ad07c788e6839e8c48bec49538b1a3dbb61ce44cad7ccdbc395480c45ea4
-
SHA512
97b22bd1c15c44f7b8a2738b33b122908be392ebfeb7be59e9ed4358ceaeaf84d2ddd4b8fcac601869b9f2277c8d9ed95add0dd3efa9359d34ad090ad0cb2f9a
-
SSDEEP
3072:gQ7pWdHCS+lwr3D1LeAOGGuL2+MSpFRV+nE28GwGlEdUcKGvO6:gYWdHCSX1LWGGuC3SpT285GlEdGGW6
Malware Config
Signatures
-
Sets file execution options in registry 2 TTPs 2 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "C:\\Windows\\system32\\ctfmon_no.exe" regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F6B29D44-BC26-3340-B84F-95B1F88447C0} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F6B29D44-BC26-3340-B84F-95B1F88447C0}\IExplore = "1" regsvr32.exe -
Drops file in System32 directory 1 IoCs
Processes:
regsvr32.exedescription ioc process File created C:\Windows\SysWOW64\ctfmon_no.exe regsvr32.exe -
Modifies registry class 41 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D.1\CLSID\ = "{F6B29D44-BC26-3340-B84F-95B1F88447C0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6B29D44-BC26-3340-B84F-95B1F88447C0}\ProgID\ = "D.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A048A70-FA75-32AC-8A00-A0341467EA62}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DFFB704-5F53-35AA-8AF5-AD8762AE6205}\TypeLib\ = "{1A048A70-FA75-32AC-8A00-A0341467EA62}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A048A70-FA75-32AC-8A00-A0341467EA62}\1.0\ = "LIB" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A048A70-FA75-32AC-8A00-A0341467EA62}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1DFFB704-5F53-35AA-8AF5-AD8762AE6205}\TypeLib\ = "{1A048A70-FA75-32AC-8A00-A0341467EA62}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D.1\ = "D" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6B29D44-BC26-3340-B84F-95B1F88447C0}\ = "D" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A048A70-FA75-32AC-8A00-A0341467EA62}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DFFB704-5F53-35AA-8AF5-AD8762AE6205}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6B29D44-BC26-3340-B84F-95B1F88447C0}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6B29D44-BC26-3340-B84F-95B1F88447C0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8ae4ad07c788e6839e8c48bec49538b1a3dbb61ce44cad7ccdbc395480c45ea4.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6B29D44-BC26-3340-B84F-95B1F88447C0}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A048A70-FA75-32AC-8A00-A0341467EA62}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A048A70-FA75-32AC-8A00-A0341467EA62}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1DFFB704-5F53-35AA-8AF5-AD8762AE6205}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1DFFB704-5F53-35AA-8AF5-AD8762AE6205}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D\ = "D" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6B29D44-BC26-3340-B84F-95B1F88447C0}\VersionIndependentProgID\ = "D" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DFFB704-5F53-35AA-8AF5-AD8762AE6205}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DFFB704-5F53-35AA-8AF5-AD8762AE6205}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1DFFB704-5F53-35AA-8AF5-AD8762AE6205}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6B29D44-BC26-3340-B84F-95B1F88447C0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6B29D44-BC26-3340-B84F-95B1F88447C0}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DFFB704-5F53-35AA-8AF5-AD8762AE6205}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A048A70-FA75-32AC-8A00-A0341467EA62} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A048A70-FA75-32AC-8A00-A0341467EA62}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A048A70-FA75-32AC-8A00-A0341467EA62}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DFFB704-5F53-35AA-8AF5-AD8762AE6205} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6B29D44-BC26-3340-B84F-95B1F88447C0}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1A048A70-FA75-32AC-8A00-A0341467EA62}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8ae4ad07c788e6839e8c48bec49538b1a3dbb61ce44cad7ccdbc395480c45ea4.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D\CLSID\ = "{F6B29D44-BC26-3340-B84F-95B1F88447C0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DFFB704-5F53-35AA-8AF5-AD8762AE6205}\ = "IDOMPeek" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1DFFB704-5F53-35AA-8AF5-AD8762AE6205} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1DFFB704-5F53-35AA-8AF5-AD8762AE6205}\ = "IDOMPeek" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1DFFB704-5F53-35AA-8AF5-AD8762AE6205}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4500 wrote to memory of 204 4500 regsvr32.exe regsvr32.exe PID 4500 wrote to memory of 204 4500 regsvr32.exe regsvr32.exe PID 4500 wrote to memory of 204 4500 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8ae4ad07c788e6839e8c48bec49538b1a3dbb61ce44cad7ccdbc395480c45ea4.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\8ae4ad07c788e6839e8c48bec49538b1a3dbb61ce44cad7ccdbc395480c45ea4.dll2⤵
- Sets file execution options in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/204-132-0x0000000000000000-mapping.dmp