Analysis
-
max time kernel
122s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 20:01
Static task
static1
Behavioral task
behavioral1
Sample
39eca13489254fae979125db56b92baa.exe
Resource
win7-20231215-en
General
-
Target
39eca13489254fae979125db56b92baa.exe
-
Size
75KB
-
MD5
39eca13489254fae979125db56b92baa
-
SHA1
85aea2864cbe849bbd73ae32075ab9da284dda70
-
SHA256
fe69f08d2f2832770063a008acd8c542b0f334bffd123b5b45dd5a8107da0235
-
SHA512
5cb2d8235693d49b37e72678e96a5ab05d20ca0e506a9b7aa1f7f44d822f98b8fa5a64f8cd109b88e2fc08aab99d99be098729d99d2a2ef54d92ff2c998b6f17
-
SSDEEP
768:QTQodfJF4+PJjPiiMAoGrx+G3twHzVlvKF9ZQk5NAq2OSGNPgzVKZ75TIIx/65uM:Zodf7+8Q0Aq2+1g5QTSuM9fiS
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2544 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 2696 regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 39eca13489254fae979125db56b92baa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{749B4F65-6F76-4263-A666-07642B79F1E3} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{749B4F65-6F76-4263-A666-07642B79F1E3}\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 39eca13489254fae979125db56b92baa.exe -
Modifies registry class 56 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2991F100-D9C3-4243-82A2-A718747FC0CF}\1.0\0\win32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2991F100-D9C3-4243-82A2-A718747FC0CF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{749B4F65-6F76-4263-A666-07642B79F1E3}\TypeLib\ = "{F5604774-9DDB-4DAA-8BE0-372044A910AA}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\TypeLib regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\NumMethods regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{749B4F65-6F76-4263-A666-07642B79F1E3} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{749B4F65-6F76-4263-A666-07642B79F1E3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\BBDNS.Dll" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\URLRedirection.URLRedirectionBHO regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\ProxyStubClsid32\ = "{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\URLRedirection.URLRedirectionBHO.1\CLSID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\VersionIndependentProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\ProxyStubClsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\InProcServer32\ = "C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{749B4F65-6F76-4263-A666-07642B79F1E3}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{749B4F65-6F76-4263-A666-07642B79F1E3}\TypeLib regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AcroIEHelperShim.AcroIEHelperShimObj.1\CLSID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\AcroIEHelperShim.DLL regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{749B4F65-6F76-4263-A666-07642B79F1E3}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{749B4F65-6F76-4263-A666-07642B79F1E3}\Version regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\URLRedirection.URLRedirectionBHO\CLSID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AcroIEHelperShim.AcroIEHelperShimObj.1 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AcroIEHelperShim.AcroIEHelperShimObj\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\URLRedirection.URLRedirectionBHO\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\ = "PSFactoryBuffer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{749B4F65-6F76-4263-A666-07642B79F1E3}\ = "BDN" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AcroIEHelperShim.AcroIEHelperShimObj\CurVer regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2991F100-D9C3-4243-82A2-A718747FC0CF}\1.0\0 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2991F100-D9C3-4243-82A2-A718747FC0CF}\1.0\HELPDIR regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{77AB4812-5411-4EA9-8437-77AD0F230302} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AcroIEHelperShim.AcroIEHelperShimObj regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{749B4F65-6F76-4263-A666-07642B79F1E3}\Version\ = "1.0" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\ = "IAcroIEHelperShimObj" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\ProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\VersionIndependentProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2991F100-D9C3-4243-82A2-A718747FC0CF}\1.0\FLAGS regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2991F100-D9C3-4243-82A2-A718747FC0CF}\1.0 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\URLRedirection.URLRedirectionBHO.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\NumMethods\ = "7" regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2908 39eca13489254fae979125db56b92baa.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2696 2908 39eca13489254fae979125db56b92baa.exe 29 PID 2908 wrote to memory of 2696 2908 39eca13489254fae979125db56b92baa.exe 29 PID 2908 wrote to memory of 2696 2908 39eca13489254fae979125db56b92baa.exe 29 PID 2908 wrote to memory of 2696 2908 39eca13489254fae979125db56b92baa.exe 29 PID 2908 wrote to memory of 2696 2908 39eca13489254fae979125db56b92baa.exe 29 PID 2908 wrote to memory of 2696 2908 39eca13489254fae979125db56b92baa.exe 29 PID 2908 wrote to memory of 2696 2908 39eca13489254fae979125db56b92baa.exe 29 PID 2908 wrote to memory of 2808 2908 39eca13489254fae979125db56b92baa.exe 30 PID 2908 wrote to memory of 2808 2908 39eca13489254fae979125db56b92baa.exe 30 PID 2908 wrote to memory of 2808 2908 39eca13489254fae979125db56b92baa.exe 30 PID 2908 wrote to memory of 2808 2908 39eca13489254fae979125db56b92baa.exe 30 PID 2908 wrote to memory of 2808 2908 39eca13489254fae979125db56b92baa.exe 30 PID 2908 wrote to memory of 2808 2908 39eca13489254fae979125db56b92baa.exe 30 PID 2908 wrote to memory of 2808 2908 39eca13489254fae979125db56b92baa.exe 30 PID 2908 wrote to memory of 2588 2908 39eca13489254fae979125db56b92baa.exe 31 PID 2908 wrote to memory of 2588 2908 39eca13489254fae979125db56b92baa.exe 31 PID 2908 wrote to memory of 2588 2908 39eca13489254fae979125db56b92baa.exe 31 PID 2908 wrote to memory of 2588 2908 39eca13489254fae979125db56b92baa.exe 31 PID 2908 wrote to memory of 2588 2908 39eca13489254fae979125db56b92baa.exe 31 PID 2908 wrote to memory of 2588 2908 39eca13489254fae979125db56b92baa.exe 31 PID 2908 wrote to memory of 2588 2908 39eca13489254fae979125db56b92baa.exe 31 PID 2908 wrote to memory of 2536 2908 39eca13489254fae979125db56b92baa.exe 32 PID 2908 wrote to memory of 2536 2908 39eca13489254fae979125db56b92baa.exe 32 PID 2908 wrote to memory of 2536 2908 39eca13489254fae979125db56b92baa.exe 32 PID 2908 wrote to memory of 2536 2908 39eca13489254fae979125db56b92baa.exe 32 PID 2908 wrote to memory of 2536 2908 39eca13489254fae979125db56b92baa.exe 32 PID 2908 wrote to memory of 2536 2908 39eca13489254fae979125db56b92baa.exe 32 PID 2908 wrote to memory of 2536 2908 39eca13489254fae979125db56b92baa.exe 32 PID 2908 wrote to memory of 2544 2908 39eca13489254fae979125db56b92baa.exe 33 PID 2908 wrote to memory of 2544 2908 39eca13489254fae979125db56b92baa.exe 33 PID 2908 wrote to memory of 2544 2908 39eca13489254fae979125db56b92baa.exe 33 PID 2908 wrote to memory of 2544 2908 39eca13489254fae979125db56b92baa.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\39eca13489254fae979125db56b92baa.exe"C:\Users\Admin\AppData\Local\Temp\39eca13489254fae979125db56b92baa.exe"1⤵
- Installs/modifies Browser Helper Object
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Roaming\Microsoft\BBDNS.Dll2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2696
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s /u "C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll2⤵
- Modifies registry class
PID:2808
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s /u "C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL2⤵
- Modifies registry class
PID:2588
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s /u "C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL2⤵PID:2536
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\39eca13489254fae979125db56b92baa.exe2⤵
- Deletes itself
PID:2544
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD5c437ddd7bd995bc7534efdd9c804e042
SHA161cee341d82af3eba2f66629522c1f066ce8aa1b
SHA2561244e7c70904abaa07773eef41566da84eb81bbf18f95124f4991d41a05e593f
SHA5120bfcd744babec6493e9cbda8b5bf25c41d0e546dfc1f9495d8f41ca7f4e7044245159c8cc122b4807ca2677250954288cfe8b70bfe22a47c12fc9564f1d309ad