Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 14:22
Static task
static1
Behavioral task
behavioral1
Sample
cf88acbcfb3448dc41927279cedd1fbe7bcd352b54e1aa7f2623fe98b761335d.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
General
-
Target
cf88acbcfb3448dc41927279cedd1fbe7bcd352b54e1aa7f2623fe98b761335d.dll
-
Size
208KB
-
MD5
d1444eca8bb158762ae975ef8a3b8768
-
SHA1
a42063ebbdffe1fc89efebedb77db39291bc7ee2
-
SHA256
cf88acbcfb3448dc41927279cedd1fbe7bcd352b54e1aa7f2623fe98b761335d
-
SHA512
19496d25ca76a378468126ccdaed43ab19cb50bbb608323b79a58a0e3fcbafda54b2bde75244a6da8bf09c6eae0cdc05e272fbd6c2579c05decbb8a8aa7ddc6e
-
SSDEEP
3072:F4Ku+qFjjmoWrUMxKX1sUko/T3DzUjJ+sZ+89G3bc5gnkhmQLizQk2:KKubF/Mx7b0DzKZ4btnkhm1z
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\ = "LivingPlay" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\NoExplorer = "1" regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\ = "_ITextLinksEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cf88acbcfb3448dc41927279cedd1fbe7bcd352b54e1aa7f2623fe98b761335d.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\lptlIE.DLL\AppID = "{EF1B578C-4058-4062-890F-31694233FEA5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cf88acbcfb3448dc41927279cedd1fbe7bcd352b54e1aa7f2623fe98b761335d.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\lptlIE.DLL regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\TypeLib\ = "{8006F89E-63A1-402A-8DB7-08A4C58F95AA}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\TypeLib\ = "{8006F89E-63A1-402A-8DB7-08A4C58F95AA}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks.1\CLSID\ = "{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks\CLSID\ = "{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{EF1B578C-4058-4062-890F-31694233FEA5}\ = "lptlIE" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\TypeLib\ = "{8006F89E-63A1-402A-8DB7-08A4C58F95AA}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}\1.0\ = "lptlIE 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\ = "ITextLinks" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{EF1B578C-4058-4062-890F-31694233FEA5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks\ = "LivingPlay" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\ = "ITextLinks" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\VersionIndependentProgID\ = "lptlIE.TextLinks" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F19F56EB-DEBF-4B1A-AA72-331A0D091C26}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\ = "_ITextLinksEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks.1\ = "LivingPlay" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\ = "LivingPlay" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks\CurVer\ = "lptlIE.TextLinks.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\ProgID\ = "lptlIE.TextLinks.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8006F89E-63A1-402A-8DB7-08A4C58F95AA}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\TypeLib\ = "{8006F89E-63A1-402A-8DB7-08A4C58F95AA}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lptlIE.TextLinks regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9291F9E-7010-4D7A-8DF6-455DEEF8EF51}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4256C66-8177-4E19-8A13-2D43B2282D0D}\TypeLib\ = "{8006F89E-63A1-402A-8DB7-08A4C58F95AA}" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3812 wrote to memory of 856 3812 regsvr32.exe 83 PID 3812 wrote to memory of 856 3812 regsvr32.exe 83 PID 3812 wrote to memory of 856 3812 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\cf88acbcfb3448dc41927279cedd1fbe7bcd352b54e1aa7f2623fe98b761335d.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\cf88acbcfb3448dc41927279cedd1fbe7bcd352b54e1aa7f2623fe98b761335d.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:856
-