Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02/02/2024, 21:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VirusShare-000605d7cbb3928b07f8e7473c820f4c.dll
Resource
win7-20231215-en
3 signatures
150 seconds
General
-
Target
VirusShare-000605d7cbb3928b07f8e7473c820f4c.dll
-
Size
610KB
-
MD5
000605d7cbb3928b07f8e7473c820f4c
-
SHA1
52ca1593477b8f8202433f5af7befda988742d0b
-
SHA256
32769d406d519a002aa0e8c7a410cf029d6ff567a47f549e95d6011c22cc9dda
-
SHA512
4c944a7d8043c347bc0260c799159471ec9f568273c44ec27c1e27516cfb45833ffa6392ad0bede2177491b1b6e239f1247927105f45c55fdf3d8e265dce5ad6
-
SSDEEP
12288:JyA1ZdqVfv/6HftOIA3+00wstpSdCi3TLdLOGLFEI2r/VBwBxHeIBv7pj:Z1fqZCHwIr00taCiHp/+I0/UVeIBT
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{CC01FC6C-A41B-D46D-876C-52A9A89BA855} regsvr32.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-A41B-D46D-876C-52A9A89BA855} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-A41B-D46D-876C-52A9A89BA855}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VirusShare-000605d7cbb3928b07f8e7473c820f4c.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VirusShare-000605d7cbb3928b07f8e7473c820f4c.sb\ = "sb" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VirusShare-000605d7cbb3928b07f8e7473c820f4c.sb\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-A41B-D46D-876C-52A9A89BA855}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-A41B-D46D-876C-52A9A89BA855}\ = "sb" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-A41B-D46D-876C-52A9A89BA855}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-A41B-D46D-876C-52A9A89BA855}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VirusShare-000605d7cbb3928b07f8e7473c820f4c.sb regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VirusShare-000605d7cbb3928b07f8e7473c820f4c.sb\Clsid\ = "{CC01FC6C-A41B-D46D-876C-52A9A89BA855}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-A41B-D46D-876C-52A9A89BA855}\ProgID\ = "VirusShare-000605d7cbb3928b07f8e7473c820f4c.sb" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2268 wrote to memory of 1920 2268 regsvr32.exe 1 PID 2268 wrote to memory of 1920 2268 regsvr32.exe 1 PID 2268 wrote to memory of 1920 2268 regsvr32.exe 1 PID 2268 wrote to memory of 1920 2268 regsvr32.exe 1 PID 2268 wrote to memory of 1920 2268 regsvr32.exe 1 PID 2268 wrote to memory of 1920 2268 regsvr32.exe 1 PID 2268 wrote to memory of 1920 2268 regsvr32.exe 1
Processes
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\VirusShare-000605d7cbb3928b07f8e7473c820f4c.dll1⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1920
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\VirusShare-000605d7cbb3928b07f8e7473c820f4c.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2268