Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 19:57
Behavioral task
behavioral1
Sample
02697866ed322eac1cb757a574089ba6.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
02697866ed322eac1cb757a574089ba6.exe
Resource
win10v2004-20231222-en
General
-
Target
02697866ed322eac1cb757a574089ba6.exe
-
Size
92KB
-
MD5
02697866ed322eac1cb757a574089ba6
-
SHA1
3393b1f22f447e21d8f417c5e45f200091091e1a
-
SHA256
79f3d4ffcb38a0d20454ecaca60bfc0427c0595489c26ddf4304ac40b42448ba
-
SHA512
0c2f818bd62c1ea493a95e80b37b7096b35dab5c8f23361c33b2a7d66c4788db53e5520a6958532cd06e4e2938eef2f7b8871db1936d0899eb4409b0abb4d8fe
-
SSDEEP
768:7TToLE6M/M50JMsXDM9NtNrBDsX9Mix489Et78XKTTo1:7TToLE6M/M5Katwdx4MEWaTTo1
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2576 regsvr32.exe -
resource yara_rule behavioral1/memory/1748-0-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/1748-1-0x0000000000020000-0x0000000000038000-memory.dmp upx behavioral1/memory/1748-7-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/1748-14-0x0000000000400000-0x0000000000418000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{895CB260-BA44-45AC-82CE-A05F967485B2} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{895CB260-BA44-45AC-82CE-A05F967485B2}\ = "??????" regedit.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\lj\dllaxjsl.dll 02697866ed322eac1cb757a574089ba6.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\userid.txt 02697866ed322eac1cb757a574089ba6.exe File created C:\Windows\reg.reg 02697866ed322eac1cb757a574089ba6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 45 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7013D6F7-FE2A-485C-A4B9-5B622FD47546} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7013D6F7-FE2A-485C-A4B9-5B622FD47546}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7013D6F7-FE2A-485C-A4B9-5B622FD47546}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{895CB260-BA44-45AC-82CE-A05F967485B2}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3EC3D33-8B29-41B1-A951-24AF75E53631}\1.0\ = "QvodAdBlocker" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3EC3D33-8B29-41B1-A951-24AF75E53631}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3EC3D33-8B29-41B1-A951-24AF75E53631}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{895CB260-BA44-45AC-82CE-A05F967485B2}\ProgID\ = "QvodAdBlocker.QvodBlock" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{895CB260-BA44-45AC-82CE-A05F967485B2}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{895CB260-BA44-45AC-82CE-A05F967485B2}\VERSION\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.QvodBlock\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{895CB260-BA44-45AC-82CE-A05F967485B2}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7013D6F7-FE2A-485C-A4B9-5B622FD47546}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7013D6F7-FE2A-485C-A4B9-5B622FD47546}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{895CB260-BA44-45AC-82CE-A05F967485B2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.QvodBlock\Clsid\ = "{895CB260-BA44-45AC-82CE-A05F967485B2}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7013D6F7-FE2A-485C-A4B9-5B622FD47546}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7013D6F7-FE2A-485C-A4B9-5B622FD47546}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{895CB260-BA44-45AC-82CE-A05F967485B2}\VERSION regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7013D6F7-FE2A-485C-A4B9-5B622FD47546}\ = "_QvodBlock" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3EC3D33-8B29-41B1-A951-24AF75E53631}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3EC3D33-8B29-41B1-A951-24AF75E53631}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7013D6F7-FE2A-485C-A4B9-5B622FD47546}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{895CB260-BA44-45AC-82CE-A05F967485B2}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{895CB260-BA44-45AC-82CE-A05F967485B2}\TypeLib\ = "{F3EC3D33-8B29-41B1-A951-24AF75E53631}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.QvodBlock regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{895CB260-BA44-45AC-82CE-A05F967485B2}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3EC3D33-8B29-41B1-A951-24AF75E53631}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3EC3D33-8B29-41B1-A951-24AF75E53631}\1.0\0\win32\ = "C:\\Program Files\\lj\\dllaxjsl.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7013D6F7-FE2A-485C-A4B9-5B622FD47546}\ = "_QvodBlock" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7013D6F7-FE2A-485C-A4B9-5B622FD47546}\ = "QvodBlock" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7013D6F7-FE2A-485C-A4B9-5B622FD47546}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3EC3D33-8B29-41B1-A951-24AF75E53631}\1.0\HELPDIR\ = "C:\\Program Files\\lj" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{895CB260-BA44-45AC-82CE-A05F967485B2}\ = "QvodAdBlocker.QvodBlock" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{895CB260-BA44-45AC-82CE-A05F967485B2}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{895CB260-BA44-45AC-82CE-A05F967485B2}\InprocServer32\ = "C:\\Program Files\\lj\\dllaxjsl.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3EC3D33-8B29-41B1-A951-24AF75E53631} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7013D6F7-FE2A-485C-A4B9-5B622FD47546} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7013D6F7-FE2A-485C-A4B9-5B622FD47546}\TypeLib\ = "{F3EC3D33-8B29-41B1-A951-24AF75E53631}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{895CB260-BA44-45AC-82CE-A05F967485B2}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QvodAdBlocker.QvodBlock\ = "QvodAdBlocker.QvodBlock" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7013D6F7-FE2A-485C-A4B9-5B622FD47546}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3EC3D33-8B29-41B1-A951-24AF75E53631}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7013D6F7-FE2A-485C-A4B9-5B622FD47546}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7013D6F7-FE2A-485C-A4B9-5B622FD47546}\TypeLib\ = "{F3EC3D33-8B29-41B1-A951-24AF75E53631}" regsvr32.exe -
Runs .reg file with regedit 1 IoCs
pid Process 2488 regedit.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1748 02697866ed322eac1cb757a574089ba6.exe 1748 02697866ed322eac1cb757a574089ba6.exe 1748 02697866ed322eac1cb757a574089ba6.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1748 wrote to memory of 2576 1748 02697866ed322eac1cb757a574089ba6.exe 30 PID 1748 wrote to memory of 2576 1748 02697866ed322eac1cb757a574089ba6.exe 30 PID 1748 wrote to memory of 2576 1748 02697866ed322eac1cb757a574089ba6.exe 30 PID 1748 wrote to memory of 2576 1748 02697866ed322eac1cb757a574089ba6.exe 30 PID 1748 wrote to memory of 2576 1748 02697866ed322eac1cb757a574089ba6.exe 30 PID 1748 wrote to memory of 2576 1748 02697866ed322eac1cb757a574089ba6.exe 30 PID 1748 wrote to memory of 2576 1748 02697866ed322eac1cb757a574089ba6.exe 30 PID 1748 wrote to memory of 2692 1748 02697866ed322eac1cb757a574089ba6.exe 33 PID 1748 wrote to memory of 2692 1748 02697866ed322eac1cb757a574089ba6.exe 33 PID 1748 wrote to memory of 2692 1748 02697866ed322eac1cb757a574089ba6.exe 33 PID 1748 wrote to memory of 2692 1748 02697866ed322eac1cb757a574089ba6.exe 33 PID 1748 wrote to memory of 2692 1748 02697866ed322eac1cb757a574089ba6.exe 33 PID 1748 wrote to memory of 2692 1748 02697866ed322eac1cb757a574089ba6.exe 33 PID 1748 wrote to memory of 2692 1748 02697866ed322eac1cb757a574089ba6.exe 33 PID 2692 wrote to memory of 2488 2692 cmd.exe 32 PID 2692 wrote to memory of 2488 2692 cmd.exe 32 PID 2692 wrote to memory of 2488 2692 cmd.exe 32 PID 2692 wrote to memory of 2488 2692 cmd.exe 32 PID 2692 wrote to memory of 2488 2692 cmd.exe 32 PID 2692 wrote to memory of 2488 2692 cmd.exe 32 PID 2692 wrote to memory of 2488 2692 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\02697866ed322eac1cb757a574089ba6.exe"C:\Users\Admin\AppData\Local\Temp\02697866ed322eac1cb757a574089ba6.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files\lj\dllaxjsl.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:2576
-
-
C:\Windows\SysWOW64\cmd.execmd /c regedit.exe /s C:\Windows\reg.reg2⤵
- Suspicious use of WriteProcessMemory
PID:2692
-
-
C:\Windows\SysWOW64\regedit.exeregedit.exe /s C:\Windows\reg.reg1⤵
- Installs/modifies Browser Helper Object
- Runs .reg file with regedit
PID:2488
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
185B
MD512bd717417516054ab1e182a063055b7
SHA1d25ff40c376e932372a5c562ba8061ead8468519
SHA2566abe4d60e1dfbfabf5f53a170fce0a0675c45892c4cda089d2ef262c81171e2b
SHA512e5feabe7a7d24d0e6e0fd63662897100e17e01ac5a72c9df2002a694b705b5ad7ed0c0dfa1b50f0740400fcfdcddaba189f99038d29a841381f95ceda923c7b2
-
Filesize
32KB
MD5bf41207ec87014150c2f884bcb6a15b3
SHA14abb6e0088a7f6408a549ffdab97be173531fdf5
SHA256fd1f06dc1751f222e1f2a4442c9f45a333aee5169cba688616ca8e1f889a8dc6
SHA512c1ab38637e9755dcb5d061260c0748443e5682bcd33b911e9638a0e11fc7e31414387809ded59928edad685ed985865e29762fb5f534fd193ea964e1f1bea17d