Analysis
-
max time kernel
91s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 11:07
Static task
static1
Behavioral task
behavioral1
Sample
f705ab554acea08b1efd566d5a5119288b36a3c1e65e26f7765ddfaeb2322ef4.dll
Resource
win7-20220812-en
3 signatures
150 seconds
General
-
Target
f705ab554acea08b1efd566d5a5119288b36a3c1e65e26f7765ddfaeb2322ef4.dll
-
Size
409KB
-
MD5
6d9e1245dbfe770908444670bfe6d687
-
SHA1
98b1c79d79812f2fc2c12094c7ef922f10547fda
-
SHA256
f705ab554acea08b1efd566d5a5119288b36a3c1e65e26f7765ddfaeb2322ef4
-
SHA512
d32b2ac7db8dae9f5e022fe17d55f0dcbf281bc9ae9cb18fba53251c25fa4cbed7c59599149e8e715901eef50a910649d1ac27946ae5f8cb6cd2a76875d6d92a
-
SSDEEP
6144:ZsZnFR9H6jpyUHSxsM8shpIqZ5JUfn/vW5jYU35z59N4/IfkbVDqpvF0x3aQZ8pC:axN6jp1csM1pIqNOK1zrWgfaqpvq1Wp
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{98B822AD-6BE7-49BC-B773-97240B774080} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{98B822AD-6BE7-49BC-B773-97240B774080}\ = "HttpGuard" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{98B822AD-6BE7-49BC-B773-97240B774080}\NoExplorer = "1" regsvr32.exe -
Modifies registry class 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98B822AD-6BE7-49BC-B773-97240B774080}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f705ab554acea08b1efd566d5a5119288b36a3c1e65e26f7765ddfaeb2322ef4.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98B822AD-6BE7-49BC-B773-97240B774080}\InprocServer32\ThreadingModel = "both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AClient.HttpGuard\ = "HttpGuard Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98B822AD-6BE7-49BC-B773-97240B774080}\ = "HttpGuard Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AClient.HttpGuard\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98B822AD-6BE7-49BC-B773-97240B774080} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AClient.HttpGuard.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AClient.HttpGuard.1\CLSID\ = "{98B822AD-6BE7-49BC-B773-97240B774080}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98B822AD-6BE7-49BC-B773-97240B774080}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98B822AD-6BE7-49BC-B773-97240B774080}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98B822AD-6BE7-49BC-B773-97240B774080}\ProgID\ = "AClient.HttpGuard.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AClient.HttpGuard regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AClient.HttpGuard\CLSID\ = "{98B822AD-6BE7-49BC-B773-97240B774080}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98B822AD-6BE7-49BC-B773-97240B774080}\VersionIndependentProgID\ = "AClient.HttpGuard" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98B822AD-6BE7-49BC-B773-97240B774080}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AClient.HttpGuard.1\ = "HttpGuard Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AClient.HttpGuard.1\CLSID regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4976 wrote to memory of 1236 4976 regsvr32.exe 78 PID 4976 wrote to memory of 1236 4976 regsvr32.exe 78 PID 4976 wrote to memory of 1236 4976 regsvr32.exe 78
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f705ab554acea08b1efd566d5a5119288b36a3c1e65e26f7765ddfaeb2322ef4.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\f705ab554acea08b1efd566d5a5119288b36a3c1e65e26f7765ddfaeb2322ef4.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1236
-