Analysis

  • max time kernel
    46s
  • max time network
    51s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 03:21

General

  • Target

    753aaa26cba1aefeb9b5474707f904db2e52d3eecc68af376da1442879e6a297.dll

  • Size

    48KB

  • MD5

    c136d3472f0992e3c2ccf733a82d77a0

  • SHA1

    1a03df0c3df36c36d733bc4eb24bf88f6141b010

  • SHA256

    753aaa26cba1aefeb9b5474707f904db2e52d3eecc68af376da1442879e6a297

  • SHA512

    f3646b5e4640927c646d1c4c0841ce6acecf9535b8686b47e228158a422bd42f8b19dd4a1adb852f22c3be8aee263c58879ec65ff671120302227bdd05b41118

  • SSDEEP

    768:X5m4rQLUjEJeNP5s5+yAR+tReF11DNOCLcQY4jnZCoE9VsuFe2e7J1RHuQDYdd+V:k4kL90P5s6R+tk/Xw+J3uE1AQDYdd+

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\753aaa26cba1aefeb9b5474707f904db2e52d3eecc68af376da1442879e6a297.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\753aaa26cba1aefeb9b5474707f904db2e52d3eecc68af376da1442879e6a297.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies Internet Explorer settings
      • Modifies registry class
      PID:1948

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1880-54-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

          Filesize

          8KB

        • memory/1948-56-0x0000000075D71000-0x0000000075D73000-memory.dmp

          Filesize

          8KB