e24a81859c9c4106cb64230132a227521775774022d1f067202c4fb1c23adb14

Analysis

max time kernel
160s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20be18265dcdf0bd3d5df51e81e2e447.dll
Size

152KB
MD5

20be18265dcdf0bd3d5df51e81e2e447
SHA1

413493fcb9b4ae51ac1ba1d4879d635f235f36f6
SHA256

e24a81859c9c4106cb64230132a227521775774022d1f067202c4fb1c23adb14
SHA512

b7adae8cdaacc508e81d5c3aa573c00e0627fc2d708dbfca8ef717bc5756844839a11bf4048e73d1fc3c2992164d3d979537c567d5cc0ae7df46ade9750cbd8b
SSDEEP

3072:5QuSc1mFs9ki3BgjcFAcmdSUP9o7D5DJPsYrk7A34IU:5QuC2kiGcM8D5y

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4a80a60d-bdef-4d70-bccc-d0dad25ff951}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4a80a60d-bdef-4d70-bccc-d0dad25ff951}\AppName = "14impipe.exe"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4a80a60d-bdef-4d70-bccc-d0dad25ff951}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4a80a60d-bdef-4d70-bccc-d0dad25ff951}\Policy = "3"	regsvr32.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{827F725B-5665-4A4B-807C-A60460066CED}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96b8a0ef-0d9d-4a92-b548-376db4bbb58b}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96b8a0ef-0d9d-4a92-b548-376db4bbb58b}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50DDA533-7F95-4141-98A4-5EC64E966126}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{827F725B-5665-4A4B-807C-A60460066CED}\TypeLib\ = "{EE201AE6-533C-4947-97EA-12627D4854A0}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50DDA533-7F95-4141-98A4-5EC64E966126}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50DDA533-7F95-4141-98A4-5EC64E966126}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96b8a0ef-0d9d-4a92-b548-376db4bbb58b}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96b8a0ef-0d9d-4a92-b548-376db4bbb58b}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96b8a0ef-0d9d-4a92-b548-376db4bbb58b}\MiscStatus\1\ = "131473"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EE201AE6-533C-4947-97EA-12627D4854A0}\1.0\ = "Messenger 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A80A60D-BDEF-4D70-BCCC-D0DAD25FF951}\ = "ITemplateXMLSession"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Software\Microsoft	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A80A60D-BDEF-4D70-BCCC-D0DAD25FF951}\TypeLib\ = "{EE201AE6-533C-4947-97EA-12627D4854A0}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Software	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96b8a0ef-0d9d-4a92-b548-376db4bbb58b}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50DDA533-7F95-4141-98A4-5EC64E966126}\ = "ITemplateXMLElement"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50DDA533-7F95-4141-98A4-5EC64E966126}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A80A60D-BDEF-4D70-BCCC-D0DAD25FF951}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96b8a0ef-0d9d-4a92-b548-376db4bbb58b}\TypeLib\ = "{ee201ae6-533c-4947-97ea-12627d4854a0}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EE201AE6-533C-4947-97EA-12627D4854A0}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96b8a0ef-0d9d-4a92-b548-376db4bbb58b}\ProgID\ = "TotalRecipeSearch_14.XMLSessionPlugin.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50DDA533-7F95-4141-98A4-5EC64E966126}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A80A60D-BDEF-4D70-BCCC-D0DAD25FF951}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A80A60D-BDEF-4D70-BCCC-D0DAD25FF951}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Software\Microsoft\Windows\CurrentVersion	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96b8a0ef-0d9d-4a92-b548-376db4bbb58b}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EE201AE6-533C-4947-97EA-12627D4854A0}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A80A60D-BDEF-4D70-BCCC-D0DAD25FF951}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{827F725B-5665-4A4B-807C-A60460066CED}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EE201AE6-533C-4947-97EA-12627D4854A0}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50DDA533-7F95-4141-98A4-5EC64E966126}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A80A60D-BDEF-4D70-BCCC-D0DAD25FF951}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{827F725B-5665-4A4B-807C-A60460066CED}\TypeLib\ = "{EE201AE6-533C-4947-97EA-12627D4854A0}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TotalRecipeSearch_14.XMLSessionPlugin.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TotalRecipeSearch_14.XMLSessionPlugin\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TotalRecipeSearch_14.XMLSessionPlugin\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96b8a0ef-0d9d-4a92-b548-376db4bbb58b}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\20be18265dcdf0bd3d5df51e81e2e447.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50DDA533-7F95-4141-98A4-5EC64E966126}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50DDA533-7F95-4141-98A4-5EC64E966126}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50DDA533-7F95-4141-98A4-5EC64E966126}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A80A60D-BDEF-4D70-BCCC-D0DAD25FF951}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TotalRecipeSearch_14.XMLSessionPlugin.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TotalRecipeSearch_14.XMLSessionPlugin\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96b8a0ef-0d9d-4a92-b548-376db4bbb58b}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96b8a0ef-0d9d-4a92-b548-376db4bbb58b}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{827F725B-5665-4A4B-807C-A60460066CED}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50DDA533-7F95-4141-98A4-5EC64E966126}\TypeLib\ = "{EE201AE6-533C-4947-97EA-12627D4854A0}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A80A60D-BDEF-4D70-BCCC-D0DAD25FF951}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50DDA533-7F95-4141-98A4-5EC64E966126}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{827F725B-5665-4A4B-807C-A60460066CED}\ = "_ITemplateXMLSessionEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96b8a0ef-0d9d-4a92-b548-376db4bbb58b}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96b8a0ef-0d9d-4a92-b548-376db4bbb58b}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EE201AE6-533C-4947-97EA-12627D4854A0}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EE201AE6-533C-4947-97EA-12627D4854A0}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{827F725B-5665-4A4B-807C-A60460066CED}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{827F725B-5665-4A4B-807C-A60460066CED}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{827F725B-5665-4A4B-807C-A60460066CED}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Software\Microsoft\Windows	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96b8a0ef-0d9d-4a92-b548-376db4bbb58b}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96b8a0ef-0d9d-4a92-b548-376db4bbb58b}\VersionIndependentProgID\ = "TotalRecipeSearch_14.XMLSessionPlugin"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A80A60D-BDEF-4D70-BCCC-D0DAD25FF951}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{827F725B-5665-4A4B-807C-A60460066CED}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 3408	556	regsvr32.exe	89
PID 556 wrote to memory of 3408	556	regsvr32.exe	89
PID 556 wrote to memory of 3408	556	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\20be18265dcdf0bd3d5df51e81e2e447.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\20be18265dcdf0bd3d5df51e81e2e447.dll
  2⤵
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads