Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26-12-2023 05:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
57ac8efe0c41abc45910cecad5cbefbd.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
General
-
Target
57ac8efe0c41abc45910cecad5cbefbd.dll
-
Size
352KB
-
MD5
57ac8efe0c41abc45910cecad5cbefbd
-
SHA1
67a8c174d22d3aef9e85e4b01563db6734bea319
-
SHA256
a8057162da5c27bd345d80ae13cb3a65ea3fc37f94e8a3cb061d2822dfd6630e
-
SHA512
0af417779f28bad7593dee8ca4871c2dfc5c397f71d39e81b7fa251d7cf9bd60abecac6d57c81c6877a83ba621e5960f6666d60bc04414b2fdd9abb9de0be2f0
-
SSDEEP
6144:VF52XpUuitTrIb9riE2tdkD8c7blFoC/dnCcaHOpTjTBiYGB:T52XeuiqrikDxlbZ6HqrBGB
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ = "XML module" regsvr32.exe -
Modifies registry class 27 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D849AEFB-30D5-A1D1-09E3-941B0A4E595B}\.0\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\57ac8efe0c41abc45910cecad5cbefbd.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ProgID\ = "XML.XML.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CurVer\ = "XML.XML.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ = "XML Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\Install = "OK" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\57ac8efe0c41abc45910cecad5cbefbd.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D849AEFB-30D5-A1D1-09E3-941B0A4E595B}\.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\TypeLib\ = "{D849AEFB-30D5-A1D1-09E3-941B0A4E595B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\VersionIndependentProgID\ = "XML.XML" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\ = "XML Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML\CLSID\ = "{500BCA15-57A7-4eaf-8143-8C619470B13D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\ = "XML Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D849AEFB-30D5-A1D1-09E3-941B0A4E595B}\.0\ = "XML Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\CLSID\ = "{500BCA15-57A7-4eaf-8143-8C619470B13D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D849AEFB-30D5-A1D1-09E3-941B0A4E595B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XML.XML.1\CLSID regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2396 2408 regsvr32.exe 14 PID 2408 wrote to memory of 2396 2408 regsvr32.exe 14 PID 2408 wrote to memory of 2396 2408 regsvr32.exe 14 PID 2408 wrote to memory of 2396 2408 regsvr32.exe 14 PID 2408 wrote to memory of 2396 2408 regsvr32.exe 14 PID 2408 wrote to memory of 2396 2408 regsvr32.exe 14 PID 2408 wrote to memory of 2396 2408 regsvr32.exe 14
Processes
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\57ac8efe0c41abc45910cecad5cbefbd.dll1⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2396
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\57ac8efe0c41abc45910cecad5cbefbd.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2408