def4f0e2221314598f08b56d0fc35f169b2c67df22ce67d685fea66b374a6556

Analysis

max time kernel
95s
max time network
31s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Thunder/ComDlls/LinkSimulate.dll
Size

144KB
MD5

419886f607c1f8db0d3a34564cfa551a
SHA1

68defb5bcf408414cb88744cef38254a7d2f3a88
SHA256

4d9e630a1144cf44ac5f149dab5c83bf2d1090ba658b20dc85a0ed145fb385c8
SHA512

f2812528940ef539eee47997e5289cbf678505f0dd60aa85d156dae082b2f03458261da9b0e01d3291bd6ec801b39f5239f0836ab4ace0edb785708d5f07b1c8
SSDEEP

1536:/X15psBF0DScuvfkxDn0dcJoOc1sPKdJpkpzHYtd/wStRC5tnByL4G2tDI:/X1c4e7vfkhUcyOksCmLMdjts5tBVx

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2E6878A-49AF-4F6B-8A2F-C2A93F19EF80}\AppID = "{7381F8D4-93CB-4F11-8BFD-BFEA389708A7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2E5C57A-BA48-4B0D-A5B5-13130F9D2AA3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2E5C57A-BA48-4B0D-A5B5-13130F9D2AA3}\ProgID\ = "QQIEHelper.QQRightClick.2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2E5C57A-BA48-4B0D-A5B5-13130F9D2AA3}\VersionIndependentProgID\ = "QQIEHelper.QQRightClick"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2E5C57A-BA48-4B0D-A5B5-13130F9D2AA3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Thunder\\ComDlls\\LinkSimulate.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2E6878A-49AF-4F6B-8A2F-C2A93F19EF80}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2E6878A-49AF-4F6B-8A2F-C2A93F19EF80}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Thunder\\ComDlls\\LinkSimulate.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ThunderServer.webThunder\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2E6878A-49AF-4F6B-8A2F-C2A93F19EF80}\TypeLib\ = "{E90140FD-715A-498B-B2A3-D4D5757C51EA}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E90140FD-715A-498B-B2A3-D4D5757C51EA}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Thunder\\ComDlls\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5EA021C6-4F62-49D1-B7A8-0BDFF3FDFE35}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7381F8D4-93CB-4F11-8BFD-BFEA389708A7}\ = "LinkSimulate"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2E6878A-49AF-4F6B-8A2F-C2A93F19EF80}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2E6878A-49AF-4F6B-8A2F-C2A93F19EF80}\VersionIndependentProgID\ = "ThunderServer.webThunder"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JetCar.Netscape.1\CLSID\ = "{E2065C93-6DF5-4782-AB38-EEC53AA41C76}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JetCar.Netscape\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2065C93-6DF5-4782-AB38-EEC53AA41C76}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ThunderServer.webThunder\CurVer\ = "ThunderServer.webThunder.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E90140FD-715A-498B-B2A3-D4D5757C51EA}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{15004BAA-9BD7-4A5E-AB3D-CA45724D6305}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2E6878A-49AF-4F6B-8A2F-C2A93F19EF80}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E90140FD-715A-498B-B2A3-D4D5757C51EA}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Thunder\\ComDlls\\LinkSimulate.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5EA021C6-4F62-49D1-B7A8-0BDFF3FDFE35}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2065C93-6DF5-4782-AB38-EEC53AA41C76}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQIEHelper.QQRightClick\CLSID\ = "{E2E5C57A-BA48-4B0D-A5B5-13130F9D2AA3}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2E5C57A-BA48-4B0D-A5B5-13130F9D2AA3}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E65258-D044-4D15-B94F-65423D660319}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2E6878A-49AF-4F6B-8A2F-C2A93F19EF80}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E65258-D044-4D15-B94F-65423D660319}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2065C93-6DF5-4782-AB38-EEC53AA41C76}\VersionIndependentProgID\ = "JetCar.Netscape"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2065C93-6DF5-4782-AB38-EEC53AA41C76}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2E5C57A-BA48-4B0D-A5B5-13130F9D2AA3}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2E5C57A-BA48-4B0D-A5B5-13130F9D2AA3}\TypeLib\ = "{E90140FD-715A-498B-B2A3-D4D5757C51EA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2E6878A-49AF-4F6B-8A2F-C2A93F19EF80}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E65258-D044-4D15-B94F-65423D660319}\TypeLib\ = "{E90140FD-715A-498B-B2A3-D4D5757C51EA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2065C93-6DF5-4782-AB38-EEC53AA41C76}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JetCar.Netscape\CLSID\ = "{E2065C93-6DF5-4782-AB38-EEC53AA41C76}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2E6878A-49AF-4F6B-8A2F-C2A93F19EF80}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{15004BAA-9BD7-4A5E-AB3D-CA45724D6305}\TypeLib\ = "{E90140FD-715A-498B-B2A3-D4D5757C51EA}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{15004BAA-9BD7-4A5E-AB3D-CA45724D6305}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQIEHelper.QQRightClick\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{15004BAA-9BD7-4A5E-AB3D-CA45724D6305}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2E5C57A-BA48-4B0D-A5B5-13130F9D2AA3}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQIEHelper.QQRightClick\CurVer\ = "QQIEHelper.QQRightClick.2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ThunderServer.webThunder.1\CLSID\ = "{D2E6878A-49AF-4F6B-8A2F-C2A93F19EF80}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7381F8D4-93CB-4F11-8BFD-BFEA389708A7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2E5C57A-BA48-4B0D-A5B5-13130F9D2AA3}\AppID = "{7381F8D4-93CB-4F11-8BFD-BFEA389708A7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ThunderServer.webThunder\ = "webThunder Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQIEHelper.QQRightClick.2\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ThunderServer.webThunder.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D2E6878A-49AF-4F6B-8A2F-C2A93F19EF80}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E65258-D044-4D15-B94F-65423D660319}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E65258-D044-4D15-B94F-65423D660319}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2065C93-6DF5-4782-AB38-EEC53AA41C76}\ = "A Simulation for JetCar Netscape Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ThunderServer.webThunder\CLSID\ = "{D2E6878A-49AF-4F6B-8A2F-C2A93F19EF80}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JetCar.Netscape.1\ = "A Simulation for JetCar Netscape Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2065C93-6DF5-4782-AB38-EEC53AA41C76}\TypeLib\ = "{E90140FD-715A-498B-B2A3-D4D5757C51EA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQIEHelper.QQRightClick	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQIEHelper.QQRightClick\ = "QQRightClick Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2E5C57A-BA48-4B0D-A5B5-13130F9D2AA3}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E65258-D044-4D15-B94F-65423D660319}	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 3008	2708	regsvr32.exe	29
PID 2708 wrote to memory of 3008	2708	regsvr32.exe	29
PID 2708 wrote to memory of 3008	2708	regsvr32.exe	29
PID 2708 wrote to memory of 3008	2708	regsvr32.exe	29
PID 2708 wrote to memory of 3008	2708	regsvr32.exe	29
PID 2708 wrote to memory of 3008	2708	regsvr32.exe	29
PID 2708 wrote to memory of 3008	2708	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Thunder\ComDlls\LinkSimulate.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Thunder\ComDlls\LinkSimulate.dll
  2⤵
  - Modifies registry class
  PID:3008

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads