Analysis
- max time kernel
105s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
16/06/2023, 05:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
80c0ef2fee97b087ea21682a28b8a9bbcb925fa5f46073cfcc7d2fb90574861f.dll
Resource
win7-20230220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
80c0ef2fee97b087ea21682a28b8a9bbcb925fa5f46073cfcc7d2fb90574861f.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 80c0ef2fee97b087ea21682a28b8a9bbcb925fa5f46073cfcc7d2fb90574861f.dll
- Size 3.6MB
- Sample230616-ggb6sada93
- SHA256 80c0ef2fee97b087ea21682a28b8a9bbcb925fa5f46073cfcc7d2fb90574861f
- MD5 be22982585d2b4aaa9f4a4b1a1ef6a8d
- SHA1 3462ddedba13fb56dfc2083dd517bfb1d2125e2f
- SHA512 f2586b0c4d8a6b4c25c628dd25ce20243badaf75d71c1eeebb4dfa9b83dd8ec7ea72f73671047540309da30f3b7ef7dd9c74542c361103769118ee8a2609f09b
- SSDEEP 49152:oQRgdDzXTk+dR5hFAAvEk/ztqThPv4rMyb4tvYUTDUt4xvN20:o2KzX7D5hFA+/ztAv4rMybOu4xvN20
- MD5 SHA1 SHA512 SSDEEP
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\WanNengWBInput\10.0.2.10108\WanNengWBInfo.ini regsvr32.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CB3BC1A-2FD4-4668-B5C5-646329DD489F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CB3BC1A-2FD4-4668-B5C5-646329DD489F}\ = "万能五笔输入法" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CB3BC1A-2FD4-4668-B5C5-646329DD489F}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CB3BC1A-2FD4-4668-B5C5-646329DD489F}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\80c0ef2fee97b087ea21682a28b8a9bbcb925fa5f46073cfcc7d2fb90574861f.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CB3BC1A-2FD4-4668-B5C5-646329DD489F}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe - Suspicious use of FindShellTrayWindow 24 IoCs
pid Process 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe 4524 regsvr32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4520 wrote to memory of 4524 4520 regsvr32.exe 85 PID 4520 wrote to memory of 4524 4520 regsvr32.exe 85 PID 4520 wrote to memory of 4524 4520 regsvr32.exe 85
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\80c0ef2fee97b087ea21682a28b8a9bbcb925fa5f46073cfcc7d2fb90574861f.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\80c0ef2fee97b087ea21682a28b8a9bbcb925fa5f46073cfcc7d2fb90574861f.dll2⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4524
-