Overview
overview
7Static
static
3VirusShare...d2.exe
windows7-x64
7VirusShare...d2.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3ffTrustMed...ion.js
windows7-x64
1ffTrustMed...ion.js
windows10-2004-x64
1ff/chrome/...375.js
windows7-x64
1ff/chrome/...375.js
windows10-2004-x64
1ff/chrome/...ion.js
windows7-x64
1ff/chrome/...ion.js
windows10-2004-x64
1ie/TrustMe...75.dll
windows7-x64
6ie/TrustMe...75.dll
windows10-2004-x64
6ie/TrustMe...64.dll
windows7-x64
7ie/TrustMe...64.dll
windows10-2004-x64
7uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3Analysis
- max time kernel
185s - max time network
201s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
04/02/2024, 12:18
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
VirusShare_788f62024cd511de75199bf472fa21d2.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
VirusShare_788f62024cd511de75199bf472fa21d2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
ffTrustMediaViewerV1alpha3375chaction.js
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
ffTrustMediaViewerV1alpha3375chaction.js
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
ff/chrome/content/ffTrustMediaViewerV1alpha3375.js
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
ff/chrome/content/ffTrustMediaViewerV1alpha3375.js
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
ff/chrome/content/ffTrustMediaViewerV1alpha3375ffaction.js
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
ff/chrome/content/ffTrustMediaViewerV1alpha3375ffaction.js
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
ie/TrustMediaViewerV1alpha3375.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
ie/TrustMediaViewerV1alpha3375.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
ie/TrustMediaViewerV1alpha3375x64.dll
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
ie/TrustMediaViewerV1alpha3375x64.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
uninstall.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral18
Sample
uninstall.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target VirusShare_788f62024cd511de75199bf472fa21d2.exe
- Size 689KB
- Sample240204-pgtd3ahac5
- SHA256 d185781c5d9742b63918e7d44324026ec0424f3d0f299ee124e43241da6e6481
- MD5 788f62024cd511de75199bf472fa21d2
- SHA1 d8973491c38c5b7b24c5305b1085cd5c9cb10c23
- SHA512 898f4b161b2dde52b14317e29beea255a72e26d419ed253beec88aa9ada949f7c45495d33ebda9b11f8ef67a867f5c1422804e7f24137a9b332fc63dceb51f60
- SSDEEP 12288:nac9YixLqmDG4G4Y7jeKuVnvon+N83LwwiAn6KkM33nxDvEjeKuVcvrD+N8yLwwl:naNio8G4G37tUnvone83Z76bMHxotUc0
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation VirusShare_788f62024cd511de75199bf472fa21d2.exe - Loads dropped DLL 5 IoCs
pid Process 3928 VirusShare_788f62024cd511de75199bf472fa21d2.exe 2000 regsvr32.exe 3928 VirusShare_788f62024cd511de75199bf472fa21d2.exe 3416 regsvr32.exe 3720 regsvr32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha3375\\ie\\TrustMediaViewerV1alpha3375x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 6 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\ = "TrustMediaViewerV1alpha3375" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\NoExplorer = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\ = "TrustMediaViewerV1alpha3375" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\NoExplorer = "1" regsvr32.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\GroupPolicy VirusShare_788f62024cd511de75199bf472fa21d2.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini VirusShare_788f62024cd511de75199bf472fa21d2.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol VirusShare_788f62024cd511de75199bf472fa21d2.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI VirusShare_788f62024cd511de75199bf472fa21d2.exe - Drops file in Program Files directory 23 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ff\chrome\content\icons\Thumbs.db VirusShare_788f62024cd511de75199bf472fa21d2.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ie\TrustMediaViewerV1alpha3375.dll VirusShare_788f62024cd511de75199bf472fa21d2.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ch\TrustMediaViewerV1alpha3375.crx VirusShare_788f62024cd511de75199bf472fa21d2.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ch\TrustMediaViewerV1alpha3375.crx VirusShare_788f62024cd511de75199bf472fa21d2.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ff\chrome\content\ffTrustMediaViewerV1alpha3375.js VirusShare_788f62024cd511de75199bf472fa21d2.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ff\chrome\content\overlay.xul VirusShare_788f62024cd511de75199bf472fa21d2.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ff\chrome\content\ffTrustMediaViewerV1alpha3375ffaction.js VirusShare_788f62024cd511de75199bf472fa21d2.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ff\chrome\content\overlay.xul VirusShare_788f62024cd511de75199bf472fa21d2.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ff\chrome\content\icons VirusShare_788f62024cd511de75199bf472fa21d2.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ff\chrome.manifest VirusShare_788f62024cd511de75199bf472fa21d2.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ff\chrome.manifest VirusShare_788f62024cd511de75199bf472fa21d2.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ff\install.rdf VirusShare_788f62024cd511de75199bf472fa21d2.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ff\chrome VirusShare_788f62024cd511de75199bf472fa21d2.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ff\chrome\content\ffTrustMediaViewerV1alpha3375ffaction.js VirusShare_788f62024cd511de75199bf472fa21d2.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ff\chrome\content\icons\default\TrustMediaViewerV1alpha3375_32.png VirusShare_788f62024cd511de75199bf472fa21d2.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ie\TrustMediaViewerV1alpha3375x64.dll VirusShare_788f62024cd511de75199bf472fa21d2.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ff\install.rdf VirusShare_788f62024cd511de75199bf472fa21d2.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ff\chrome\content VirusShare_788f62024cd511de75199bf472fa21d2.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ff\chrome\content\ffTrustMediaViewerV1alpha3375.js VirusShare_788f62024cd511de75199bf472fa21d2.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ff\chrome\content\icons\Thumbs.db VirusShare_788f62024cd511de75199bf472fa21d2.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ff\chrome\content\icons\default VirusShare_788f62024cd511de75199bf472fa21d2.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ff\chrome\content\icons\default\TrustMediaViewerV1alpha3375_32.png VirusShare_788f62024cd511de75199bf472fa21d2.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\uninstall.exe VirusShare_788f62024cd511de75199bf472fa21d2.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Approved Extensions VirusShare_788f62024cd511de75199bf472fa21d2.exe Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d} = 51667a6c4c1d3b1b11a551c0d1295e0abda99f78b0b3dd02 VirusShare_788f62024cd511de75199bf472fa21d2.exe - Modifies registry class 56 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\Version\ = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFC73BFC-8DDB-47F0-AE53-274CCA4F041D}\1.1\0\win32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha3375\\ie\\TrustMediaViewerV1alpha3375.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6B7BD20-7DC6-45BE-8B51-DB56A8872BB3}\ = "ITrustMediaViewerV1alpha3375BHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d} VirusShare_788f62024cd511de75199bf472fa21d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\Implemented Categories\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6B7BD20-7DC6-45BE-8B51-DB56A8872BB3}\ = "ITrustMediaViewerV1alpha3375BHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha3375\\ie\\TrustMediaViewerV1alpha3375x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFC73BFC-8DDB-47F0-AE53-274CCA4F041D}\1.1\ = "TrustMediaViewerV1alpha3375Lib" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6B7BD20-7DC6-45BE-8B51-DB56A8872BB3} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6B7BD20-7DC6-45BE-8B51-DB56A8872BB3}\TypeLib\ = "{FFC73BFC-8DDB-47F0-AE53-274CCA4F041D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFC73BFC-8DDB-47F0-AE53-274CCA4F041D}\1.1\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6B7BD20-7DC6-45BE-8B51-DB56A8872BB3}\TypeLib\ = "{FFC73BFC-8DDB-47F0-AE53-274CCA4F041D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\Version\ = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\ = "TrustMediaViewerV1alpha3375" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\ = "Trust Media Viewer" VirusShare_788f62024cd511de75199bf472fa21d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFC73BFC-8DDB-47F0-AE53-274CCA4F041D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFC73BFC-8DDB-47F0-AE53-274CCA4F041D}\1.1\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFC73BFC-8DDB-47F0-AE53-274CCA4F041D}\1.1\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFC73BFC-8DDB-47F0-AE53-274CCA4F041D}\1.1\0\win64\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha3375\\ie\\TrustMediaViewerV1alpha3375x64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFC73BFC-8DDB-47F0-AE53-274CCA4F041D}\1.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFC73BFC-8DDB-47F0-AE53-274CCA4F041D}\1.1\HELPDIR\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha3375\\ie" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6B7BD20-7DC6-45BE-8B51-DB56A8872BB3} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6B7BD20-7DC6-45BE-8B51-DB56A8872BB3}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\TypeLib\ = "{ffc73bfc-8ddb-47f0-ae53-274cca4f041d}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFC73BFC-8DDB-47F0-AE53-274CCA4F041D}\1.1\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6B7BD20-7DC6-45BE-8B51-DB56A8872BB3}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6B7BD20-7DC6-45BE-8B51-DB56A8872BB3}\TypeLib\Version = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\TypeLib\ = "{ffc73bfc-8ddb-47f0-ae53-274cca4f041d}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6B7BD20-7DC6-45BE-8B51-DB56A8872BB3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFC73BFC-8DDB-47F0-AE53-274CCA4F041D}\1.1\0\win64 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6B7BD20-7DC6-45BE-8B51-DB56A8872BB3}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6B7BD20-7DC6-45BE-8B51-DB56A8872BB3}\TypeLib\Version = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha3375\\ie\\TrustMediaViewerV1alpha3375.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\ = "TrustMediaViewerV1alpha3375" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFC73BFC-8DDB-47F0-AE53-274CCA4F041D}\1.1\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6B7BD20-7DC6-45BE-8B51-DB56A8872BB3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6B7BD20-7DC6-45BE-8B51-DB56A8872BB3}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{dc40bd01-7ae0-4239-a9a3-c026b3f7981d}\Implemented Categories\ regsvr32.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3928 VirusShare_788f62024cd511de75199bf472fa21d2.exe 3928 VirusShare_788f62024cd511de75199bf472fa21d2.exe 3928 VirusShare_788f62024cd511de75199bf472fa21d2.exe 3928 VirusShare_788f62024cd511de75199bf472fa21d2.exe 3928 VirusShare_788f62024cd511de75199bf472fa21d2.exe 3928 VirusShare_788f62024cd511de75199bf472fa21d2.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3928 wrote to memory of 2000 3928 VirusShare_788f62024cd511de75199bf472fa21d2.exe 84 PID 3928 wrote to memory of 2000 3928 VirusShare_788f62024cd511de75199bf472fa21d2.exe 84 PID 3928 wrote to memory of 2000 3928 VirusShare_788f62024cd511de75199bf472fa21d2.exe 84 PID 3928 wrote to memory of 3416 3928 VirusShare_788f62024cd511de75199bf472fa21d2.exe 85 PID 3928 wrote to memory of 3416 3928 VirusShare_788f62024cd511de75199bf472fa21d2.exe 85 PID 3928 wrote to memory of 3416 3928 VirusShare_788f62024cd511de75199bf472fa21d2.exe 85 PID 3416 wrote to memory of 3720 3416 regsvr32.exe 86 PID 3416 wrote to memory of 3720 3416 regsvr32.exe 86 PID 3928 wrote to memory of 3772 3928 VirusShare_788f62024cd511de75199bf472fa21d2.exe 93 PID 3928 wrote to memory of 3772 3928 VirusShare_788f62024cd511de75199bf472fa21d2.exe 93 PID 3928 wrote to memory of 3772 3928 VirusShare_788f62024cd511de75199bf472fa21d2.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_788f62024cd511de75199bf472fa21d2.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_788f62024cd511de75199bf472fa21d2.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ie\TrustMediaViewerV1alpha3375.dll" /s2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2000
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ie\TrustMediaViewerV1alpha3375x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ie\TrustMediaViewerV1alpha3375x64.dll"3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:3720
-
-
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\System32\gpupdate.exe" /force2⤵PID:3772
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:3432
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:3652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ie\TrustMediaViewerV1alpha3375.dll
- Size 85KB
- SHA256 bd018deda7a1295203c9e9c9396df981f79aa6816b589debfb0916708b6d95c8
- MD5 cb7c2150ee3eca319b59deb7ccac9cd0
- SHA1 e73714ea78f5e45735c47d19fc156ce78ec6a716
- SHA512 efae90a5163311c83256fcf1e2fd8ddc62d6c62fd41b2e8e3303619f76662c677721f2b0293dd0da955cc3752e4daf185061ddacb644ff1efc318334119d5e67
- SSDEEP 1536:c5s2Sc4McEnVtKo+kNp8Dk5i518zOslQPGBJdf:p26McEnnKo+kN5i5uzraPGBJd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha3375\ie\TrustMediaViewerV1alpha3375x64.dll
- Size 100KB
- SHA256 055ceb9f5a6170f2e50b90caef3354bd1238cf40f87f034dfe09ab72fc0348a1
- MD5 8a6d961fb7f770679e486aa2df72136e
- SHA1 aabee5f45811bcfb4b6df7162b9b727cfb1d773f
- SHA512 4ef4dfe949f4c7c214973924b516c2601536cd684e5e131324e3306530364a92a49621223c0422f772a7203cb7a4ef22d8300709f1da83bb41a09c99d72eb2b6
- SSDEEP 3072:1BjCnTZPjGSRzBHsQnTfGNAj7KSWfzQBTnzF9AOd:1NCnTZPjGAlHdTONAjDtvn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsh3D82.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsh3D82.tmp\aminsis.dll
- Size 567KB
- SHA256 e78e0e61707cabec8383f1e74da9db8e0fa123a3a7b36f0080d70fbaed6f7453
- MD5 f346047b13f37f79c462e59a6319faa1
- SHA1 ce9e7cb9719000a69b463fe024c81229e322279f
- SHA512 429209cc489ba9ac2d62055b128efb3cded3e31f966c7cdb1aee592ec7a54ab090526705fa2519498d92eb4bc2efa141cd83adc6c251b793388ad1208b172167
- SSDEEP 12288:w/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9G/uf:vGnSkWh4G1ppgH81vrBu3MHOGUKfG/
- MD5 SHA1 SHA512 SSDEEP