Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 16:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7506d37a2bbe2e4497a533f4e08269fc.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
General
-
Target
7506d37a2bbe2e4497a533f4e08269fc.dll
-
Size
11KB
-
MD5
7506d37a2bbe2e4497a533f4e08269fc
-
SHA1
95561b04d07dc27de13f64c943b43bd947867bdb
-
SHA256
7e72a4749160df1ad35074064314902a9f483dafed63959d9fdb3fae465ee3d7
-
SHA512
bac7fce7127155f21e101c42e113188be32ff63c22210eb7d964c17619fd7325c690f6fc74f1e95ccfd1ef747386fb81461254dd1929dc3c07ece4e09a5778f7
-
SSDEEP
192:vbS6M0ffHPM5MorrglOLqrV0EGBwKFwjClYkG2lNW//RRw:vKIvMVQVRKwKqKlNMRi
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1C3C4699-B285-475F-BE47-0B26088CE876} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1C3C4699-B285-475F-BE47-0B26088CE876}\ regsvr32.exe -
Modifies registry class 5 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C3C4699-B285-475F-BE47-0B26088CE876}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{1C3C4699-B285-475F-BE47-0B26088CE876} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C3C4699-B285-475F-BE47-0B26088CE876}\xxx = "xxx" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{1C3C4699-B285-475F-BE47-0B26088CE876}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C3C4699-B285-475F-BE47-0B26088CE876}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7506d37a2bbe2e4497a533f4e08269fc.dll" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2536 wrote to memory of 2044 2536 regsvr32.exe regsvr32.exe PID 2536 wrote to memory of 2044 2536 regsvr32.exe regsvr32.exe PID 2536 wrote to memory of 2044 2536 regsvr32.exe regsvr32.exe PID 2536 wrote to memory of 2044 2536 regsvr32.exe regsvr32.exe PID 2536 wrote to memory of 2044 2536 regsvr32.exe regsvr32.exe PID 2536 wrote to memory of 2044 2536 regsvr32.exe regsvr32.exe PID 2536 wrote to memory of 2044 2536 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7506d37a2bbe2e4497a533f4e08269fc.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\7506d37a2bbe2e4497a533f4e08269fc.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2044