Analysis
-
max time kernel
94s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 16:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
74f20efea1e25faed274eddce32e9ca9.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
General
-
Target
74f20efea1e25faed274eddce32e9ca9.dll
-
Size
562KB
-
MD5
74f20efea1e25faed274eddce32e9ca9
-
SHA1
8a03e91d2b1da52cff9579549d79cf8d5813d1c5
-
SHA256
7e14ec9a81ce1f41c93c4b3d4061fb0728a77d29eab58bbc90735bd22523dbf8
-
SHA512
12055f345a133a9244a6387b8f1b50bc1f5ea61a3faaf6232e3dbfc69bd537283aa30fc4845c6e514a70f181093e01a5b72f08c8e9bf16c565c2390d3985132f
-
SSDEEP
12288:+0Et9YDc/Tk4Po4wSSqodPF9C2vTgYnYFaTbRp:utWDcw4o4Ts/9CknsanR
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{CC01FC6C-B8EE-F997-1E73-4CFEC39E6DEF} regsvr32.exe -
Modifies registry class 11 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\74f20efea1e25faed274eddce32e9ca9.sh\ = "sh" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-B8EE-F997-1E73-4CFEC39E6DEF}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-B8EE-F997-1E73-4CFEC39E6DEF}\ = "sh" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\74f20efea1e25faed274eddce32e9ca9.sh regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-B8EE-F997-1E73-4CFEC39E6DEF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\74f20efea1e25faed274eddce32e9ca9.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-B8EE-F997-1E73-4CFEC39E6DEF}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\74f20efea1e25faed274eddce32e9ca9.sh\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\74f20efea1e25faed274eddce32e9ca9.sh\Clsid\ = "{CC01FC6C-B8EE-F997-1E73-4CFEC39E6DEF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-B8EE-F997-1E73-4CFEC39E6DEF}\ProgID\ = "74f20efea1e25faed274eddce32e9ca9.sh" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-B8EE-F997-1E73-4CFEC39E6DEF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC01FC6C-B8EE-F997-1E73-4CFEC39E6DEF}\InprocServer32 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4404 wrote to memory of 1588 4404 regsvr32.exe regsvr32.exe PID 4404 wrote to memory of 1588 4404 regsvr32.exe regsvr32.exe PID 4404 wrote to memory of 1588 4404 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\74f20efea1e25faed274eddce32e9ca9.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\74f20efea1e25faed274eddce32e9ca9.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1588
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1588-0-0x0000000000D00000-0x0000000000D92000-memory.dmpFilesize
584KB