Analysis
-
max time kernel
179s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 00:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
219ff7e6bd1a44c492fffdb457f54ba7.dll
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
219ff7e6bd1a44c492fffdb457f54ba7.dll
-
Size
52KB
-
MD5
219ff7e6bd1a44c492fffdb457f54ba7
-
SHA1
26f3c0c9a0dc53ce58dccc0606db9eb25d4d6d42
-
SHA256
3e719b2d4193edc2d8a656454fcf8a8e946e6a1fe9a1ae96bea91759008f763a
-
SHA512
db047be272e416bb4a9a62774583faf06ceb616756685737a1b28017f5a021a04d6719800caa7a376cb32aba2d840b4d92a96b303430825b5b851056cbb53cb7
-
SSDEEP
768:jocINMCjbZZmrFS5hRxhzJBaK/UXEbhayyg+6Tq3FIUIbb5mXfgAaLrLsJ5yb:ccGDvK8rhlBZ/vbAyCT3RWmYAsLZ
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7BA4C38C-6BE5-4F3C-980B-CEB48A777413} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7BA4C38C-6BE5-4F3C-980B-CEB48A777413}\NoExplorer = "1" regsvr32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2344 4372 WerFault.exe 90 -
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{20C3857E-3A7A-48FF-8C16-8BAFFDF5EE77}\DisplayName = "°Ù¶È" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{20C3857E-3A7A-48FF-8C16-8BAFFDF5EE77}\URL = "http://www.baidu.com/s?tn=leizhen_dg&ie=utf-8&wd={searchTerms}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6C08444C-B736-4C01-99A8-4CC9E59A9BC9} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\SearchScopes\{20C3857E-3A7A-48FF-8C16-8BAFFDF5EE77} regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{20C3857E-3A7A-48FF-8C16-8BAFFDF5EE77}\SuggestionsURL_JSON = "http://suggestion.baidu.com/su?wd={searchTerms}&action=opensearch&ie=utf-8&from=ie8" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6C08444C-B736-4C01-99A8-4CC9E59A9BC9}\DisplayName = "Google" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6C08444C-B736-4C01-99A8-4CC9E59A9BC9}\URL = "http://www.gggdu.com/google?q={searchTerms}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\SearchScopes regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{20C3857E-3A7A-48FF-8C16-8BAFFDF5EE77}" regsvr32.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BA4C38C-6BE5-4F3C-980B-CEB48A777413}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BA4C38C-6BE5-4F3C-980B-CEB48A777413} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shell\OpenHomePage\Command regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shell regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shell\OpenHomePage regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7BA4C38C-6BE5-4F3C-980B-CEB48A777413}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\219ff7e6bd1a44c492fffdb457f54ba7.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\DefaultIcon regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4544 wrote to memory of 4372 4544 regsvr32.exe 90 PID 4544 wrote to memory of 4372 4544 regsvr32.exe 90 PID 4544 wrote to memory of 4372 4544 regsvr32.exe 90
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\219ff7e6bd1a44c492fffdb457f54ba7.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\219ff7e6bd1a44c492fffdb457f54ba7.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:4372 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 8803⤵
- Program crash
PID:2344
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4372 -ip 43721⤵PID:1072