Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04/01/2024, 00:45
Static task
static1
Behavioral task
behavioral1
Sample
3f779cbd793bb0b2d61e5925953ef474.exe
Resource
win7-20231129-en
General
-
Target
3f779cbd793bb0b2d61e5925953ef474.exe
-
Size
204KB
-
MD5
3f779cbd793bb0b2d61e5925953ef474
-
SHA1
9102cb5747aaa47fe162714026a21251fe215770
-
SHA256
1488eb28612b1110c7062e85a2053f4f4d6ee6eb0260767e9f55189a15f17b2f
-
SHA512
f98e33086f1a94524eff4b5265ec5dc7421e48daccf0220b36abbb960961864cd13dd8cea9a0affb465faba143730926d51328412a5172de3d251c696d0d6158
-
SSDEEP
6144:4lIuNb9o9yWokqP4kYajPWf14/AK9PyPjV:jW9FWovPGajPIJUP6V
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2024 3f779cbd793bb0b2d61e5925953ef474.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{08804AF8-7D13-B6A8-52F0-5286F0CAF48A} 3f779cbd793bb0b2d61e5925953ef474.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\3f779cbd793bb0b2d61e5925953ef474.exe 3f779cbd793bb0b2d61e5925953ef474.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\altcmd\altcmd.inf 3f779cbd793bb0b2d61e5925953ef474.exe File opened for modification C:\Program Files (x86)\altcmd\altcmd.inf 3f779cbd793bb0b2d61e5925953ef474.exe File created C:\Program Files (x86)\altcmd\uninstall.bat 3f779cbd793bb0b2d61e5925953ef474.exe File opened for modification C:\Program Files (x86)\altcmd\uninstall.bat 3f779cbd793bb0b2d61e5925953ef474.exe File created C:\Program Files (x86)\altcmd\altcmd32.dll 3f779cbd793bb0b2d61e5925953ef474.exe File opened for modification C:\Program Files (x86)\altcmd\altcmd32.dll 3f779cbd793bb0b2d61e5925953ef474.exe -
Modifies registry class 60 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\Version = "1.0" 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5} 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1\ = "BhoApp Class" 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1\CLSID 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CLSID\ = "{08804AF8-7D13-B6A8-52F0-5286F0CAF48A}" 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0\win32\ = "C:\\Program Files (x86)\\altcmd\\altcmd32.dll" 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ = "IBhoApp" 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08804AF8-7D13-B6A8-52F0-5286F0CAF48A}\ = "BhoApp Class" 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\Version = "1.0" 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91} 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\Version = "1.0" 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\HELPDIR 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\ = "BhoApp Class" 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08804AF8-7D13-B6A8-52F0-5286F0CAF48A}\ProgID 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0\win32 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226} 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ = "_IBhoAppEvents" 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CurVer 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08804AF8-7D13-B6A8-52F0-5286F0CAF48A}\TypeLib 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08804AF8-7D13-B6A8-52F0-5286F0CAF48A}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\FLAGS 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08804AF8-7D13-B6A8-52F0-5286F0CAF48A}\VersionIndependentProgID\ = "MsVCL1.BhoApp" 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ = "IBhoApp" 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1\CLSID\ = "{08804AF8-7D13-B6A8-52F0-5286F0CAF48A}" 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08804AF8-7D13-B6A8-52F0-5286F0CAF48A}\ProgID\ = "MsVCL1.BhoApp.1" 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08804AF8-7D13-B6A8-52F0-5286F0CAF48A}\InprocServer32\ThreadingModel = "Apartment" 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\FLAGS\ = "0" 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91} 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CLSID 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08804AF8-7D13-B6A8-52F0-5286F0CAF48A}\VersionIndependentProgID 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ = "_IBhoAppEvents" 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\Version = "1.0" 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08804AF8-7D13-B6A8-52F0-5286F0CAF48A}\Programmable 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08804AF8-7D13-B6A8-52F0-5286F0CAF48A}\InprocServer32 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\altcmd\\" 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CurVer\ = "MsVCL1.BhoApp.1" 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\ = "MsVCL1 1.0 Type Library" 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08804AF8-7D13-B6A8-52F0-5286F0CAF48A} 3f779cbd793bb0b2d61e5925953ef474.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08804AF8-7D13-B6A8-52F0-5286F0CAF48A}\InprocServer32\ = "C:\\Program Files (x86)\\altcmd\\altcmd32.dll" 3f779cbd793bb0b2d61e5925953ef474.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5} 3f779cbd793bb0b2d61e5925953ef474.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2024 3f779cbd793bb0b2d61e5925953ef474.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2024 wrote to memory of 2548 2024 3f779cbd793bb0b2d61e5925953ef474.exe 28 PID 2024 wrote to memory of 2548 2024 3f779cbd793bb0b2d61e5925953ef474.exe 28 PID 2024 wrote to memory of 2548 2024 3f779cbd793bb0b2d61e5925953ef474.exe 28 PID 2024 wrote to memory of 2548 2024 3f779cbd793bb0b2d61e5925953ef474.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f779cbd793bb0b2d61e5925953ef474.exe"C:\Users\Admin\AppData\Local\Temp\3f779cbd793bb0b2d61e5925953ef474.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\1B6D.bat2⤵PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231B
MD5d63578f74b1c4e1905476303df8247bf
SHA164ba407b09f39776be0ff222686afb5bde2be243
SHA256c30a8090b1a760e4859c967256656c63842ef07e9066cdc7e6a44afb037e4389
SHA51237b34d0ccec3273e34710bbe7d04c4af020d87d0bbd510a8feac317309aa2f95fb253f55243efa95cff5ec85c33dfa16e5bb7a69b0c486cec1c98220dbf6256e
-
Filesize
180KB
MD57a2fd750427043d5640f82d745759af8
SHA18ec7c9a1a1277611a3dc3aba2e9430ff4aa0839a
SHA25638c5b2dc0f3eb89a46bc5b7ac8b03f01f656b1bc06d86f5cf1a03a61a4f076b9
SHA5129256820df7291580f397190fc6e53867059a420f40d14e3846833dba4f93d554d6dc0f8f7b79ef4355c64ae447f43cfdb2da0efc4180d9cecc1a5011af510b97