Analysis
-
max time kernel
152s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 02:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0bb37a499bff85249d5de4a4c555d760.dll
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
General
-
Target
0bb37a499bff85249d5de4a4c555d760.dll
-
Size
30KB
-
MD5
0bb37a499bff85249d5de4a4c555d760
-
SHA1
b5ae34fff45d287547f10159aef38a0f0bf227e3
-
SHA256
cab7050a7a7e38993f7eea2cb7eb0b4a5b42b57ba487a4241944cdc35398671c
-
SHA512
262d3f079abb380fea17ed4f25db25d69e243e33df1b6c66fd576ebc86fc09823f24cfc473bafe061d81c67fb65c9ef55fad1da31181962ba4851145e7300f83
-
SSDEEP
768:gSQ/gd/WDh4npIPeeFeHmXFaNP8sa7wUW0O81RJq/z:gDgdgPDRVyEDe0O6q/
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7558760D-04F0-4FA5-9111-22E0C8813509} regsvr32.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\hosts regsvr32.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\sp.html" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Search\SearchAssistant = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\sp.html" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\sp.html" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use Custom Search URL = "1" regsvr32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use Search Asst = "no" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\HOMEOldSP = "about:blank" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Use Custom Search URL = "1" regsvr32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Search regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Bar = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\sp.html" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Use Search Asst = "no" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\HOMEOldSP = "about:blank" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\sp.html" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Search regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\sp.html" regsvr32.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "about:blank" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "about:blank" regsvr32.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D729F35D-BABE-433B-A15B-BD5207CC7010}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7558760D-04F0-4FA5-9111-22E0C8813509}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D729F35D-BABE-433B-A15B-BD5207CC7010}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain\CLSID = "{D729F35D-BABE-433B-A15B-BD5207CC7010}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7558760D-04F0-4FA5-9111-22E0C8813509}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7558760D-04F0-4FA5-9111-22E0C8813509} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7558760D-04F0-4FA5-9111-22E0C8813509}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0bb37a499bff85249d5de4a4c555d760.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html\CLSID = "{D729F35D-BABE-433B-A15B-BD5207CC7010}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D729F35D-BABE-433B-A15B-BD5207CC7010} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D729F35D-BABE-433B-A15B-BD5207CC7010}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0bb37a499bff85249d5de4a4c555d760.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2820 wrote to memory of 4452 2820 regsvr32.exe 36 PID 2820 wrote to memory of 4452 2820 regsvr32.exe 36 PID 2820 wrote to memory of 4452 2820 regsvr32.exe 36
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0bb37a499bff85249d5de4a4c555d760.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0bb37a499bff85249d5de4a4c555d760.dll2⤵
- Drops file in Drivers directory
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
PID:4452
-