Overview
overview
7Static
static
3VirusShare...55.exe
windows7-x64
7VirusShare...55.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3ffTrustMed...ion.js
windows7-x64
1ffTrustMed...ion.js
windows10-2004-x64
1ff/chrome/...001.js
windows7-x64
1ff/chrome/...001.js
windows10-2004-x64
1ff/chrome/...ion.js
windows7-x64
1ff/chrome/...ion.js
windows10-2004-x64
1ie/TrustMe...01.dll
windows7-x64
6ie/TrustMe...01.dll
windows10-2004-x64
6ie/TrustMe...64.dll
windows7-x64
7ie/TrustMe...64.dll
windows10-2004-x64
7uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3Analysis
- max time kernel
145s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
04/02/2024, 16:11
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
ffTrustMediaViewerV1alpha6001chaction.js
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
ffTrustMediaViewerV1alpha6001chaction.js
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
ff/chrome/content/ffTrustMediaViewerV1alpha6001.js
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
ff/chrome/content/ffTrustMediaViewerV1alpha6001.js
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
ff/chrome/content/ffTrustMediaViewerV1alpha6001ffaction.js
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
ff/chrome/content/ffTrustMediaViewerV1alpha6001ffaction.js
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
ie/TrustMediaViewerV1alpha6001.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
ie/TrustMediaViewerV1alpha6001.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
ie/TrustMediaViewerV1alpha6001x64.dll
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
ie/TrustMediaViewerV1alpha6001x64.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
uninstall.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral18
Sample
uninstall.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe
- Size 689KB
- Sample240204-tm7wvsgabj
- SHA256 b0df4fe2b1194649fddd69937576acd03d26d8490d0aa2683fda1abfff63f4c9
- MD5 2979570d9b6f2a7f85bef096e7fbd855
- SHA1 dcbc8b3248fcedeb7acedd54eab131cbfb00c7b9
- SHA512 0df7f8a2e3205730980cfb988e06b2bfca21b5904f349e54aa83061b779a84952bc8dc0ba1efc366457efa1e10c99ba8a73d91cad53533feee8fecdcf2e9b8cb
- SSDEEP 12288:MEiISTgJG4G4Y7jeKuVnvon+N83LwwiAn6KkM33nxDdjeKuVOvjr+N8GLwwi5n6Z:MTEJG4G37tUnvone83Z76bMHxxtUOvjG
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe - Loads dropped DLL 5 IoCs
pid Process 2920 VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe 1988 regsvr32.exe 2920 VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe 472 regsvr32.exe 3436 regsvr32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha6001\\ie\\TrustMediaViewerV1alpha6001x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 6 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{725e0daf-5501-4be7-881c-144101fbea71} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{725e0daf-5501-4be7-881c-144101fbea71}\ = "TrustMediaViewerV1alpha6001" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{725e0daf-5501-4be7-881c-144101fbea71}\NoExplorer = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{725e0daf-5501-4be7-881c-144101fbea71} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{725e0daf-5501-4be7-881c-144101fbea71}\ = "TrustMediaViewerV1alpha6001" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{725e0daf-5501-4be7-881c-144101fbea71}\NoExplorer = "1" regsvr32.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\GroupPolicy VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe - Drops file in Program Files directory 23 IoCs
description ioc Process File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ch\TrustMediaViewerV1alpha6001.crx VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ff\chrome.manifest VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ff\install.rdf VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ff\chrome\content VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ff\chrome\content\overlay.xul VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ff\chrome\content\icons\Thumbs.db VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ie\TrustMediaViewerV1alpha6001.dll VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ch\TrustMediaViewerV1alpha6001.crx VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ff\install.rdf VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ff\chrome VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ff\chrome\content\ffTrustMediaViewerV1alpha6001ffaction.js VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ff\chrome\content\ffTrustMediaViewerV1alpha6001ffaction.js VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ff\chrome\content\icons\default\TrustMediaViewerV1alpha6001_32.png VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ie\TrustMediaViewerV1alpha6001x64.dll VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ff\chrome\content\ffTrustMediaViewerV1alpha6001.js VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ff\chrome\content\icons\default VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ff\chrome\content\ffTrustMediaViewerV1alpha6001.js VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ff\chrome\content\overlay.xul VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ff\chrome\content\icons VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ff\chrome\content\icons\Thumbs.db VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ff\chrome\content\icons\default\TrustMediaViewerV1alpha6001_32.png VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File created C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\uninstall.exe VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe File opened for modification C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ff\chrome.manifest VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Approved Extensions VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{725e0daf-5501-4be7-881c-144101fbea71} = 51667a6c4c1d3b1bbf1a44683e028b01911f4b1502baac6f VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe - Modifies registry class 56 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{932A5E6E-B557-40CC-9EE5-ECF147433486}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E80F2C2-22E4-403A-98F9-EDEC6843D802}\1.1\0\win64 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\Version\ = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725e0daf-5501-4be7-881c-144101fbea71} VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{932A5E6E-B557-40CC-9EE5-ECF147433486}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{932A5E6E-B557-40CC-9EE5-ECF147433486}\TypeLib\ = "{4E80F2C2-22E4-403A-98F9-EDEC6843D802}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{932A5E6E-B557-40CC-9EE5-ECF147433486}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\TypeLib\ = "{4e80f2c2-22e4-403a-98f9-edec6843d802}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E80F2C2-22E4-403A-98F9-EDEC6843D802}\1.1\0\win64\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha6001\\ie\\TrustMediaViewerV1alpha6001x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E80F2C2-22E4-403A-98F9-EDEC6843D802}\1.1\0\win32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha6001\\ie\\TrustMediaViewerV1alpha6001.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\Implemented Categories\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E80F2C2-22E4-403A-98F9-EDEC6843D802}\1.1\ = "TrustMediaViewerV1alpha6001Lib" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{932A5E6E-B557-40CC-9EE5-ECF147433486}\ = "ITrustMediaViewerV1alpha6001BHO" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{932A5E6E-B557-40CC-9EE5-ECF147433486}\ = "ITrustMediaViewerV1alpha6001BHO" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\Implemented Categories\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{932A5E6E-B557-40CC-9EE5-ECF147433486}\TypeLib\ = "{4E80F2C2-22E4-403A-98F9-EDEC6843D802}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E80F2C2-22E4-403A-98F9-EDEC6843D802}\1.1\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{932A5E6E-B557-40CC-9EE5-ECF147433486}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\ = "TrustMediaViewerV1alpha6001" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\TypeLib\ = "{4e80f2c2-22e4-403a-98f9-edec6843d802}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E80F2C2-22E4-403A-98F9-EDEC6843D802}\1.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E80F2C2-22E4-403A-98F9-EDEC6843D802}\1.1\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{725e0daf-5501-4be7-881c-144101fbea71} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\ = "TrustMediaViewerV1alpha6001" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha6001\\ie\\TrustMediaViewerV1alpha6001.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\InprocServer32\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha6001\\ie\\TrustMediaViewerV1alpha6001x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{932A5E6E-B557-40CC-9EE5-ECF147433486}\TypeLib\Version = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{932A5E6E-B557-40CC-9EE5-ECF147433486}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E80F2C2-22E4-403A-98F9-EDEC6843D802} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E80F2C2-22E4-403A-98F9-EDEC6843D802}\1.1\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E80F2C2-22E4-403A-98F9-EDEC6843D802}\1.1\HELPDIR\ = "C:\\Program Files (x86)\\TrustMediaViewerV1\\TrustMediaViewerV1alpha6001\\ie" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{932A5E6E-B557-40CC-9EE5-ECF147433486} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{932A5E6E-B557-40CC-9EE5-ECF147433486}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\Version\ = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{932A5E6E-B557-40CC-9EE5-ECF147433486} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E80F2C2-22E4-403A-98F9-EDEC6843D802}\1.1\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\ = "Trust Media Viewer" VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725e0daf-5501-4be7-881c-144101fbea71} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4E80F2C2-22E4-403A-98F9-EDEC6843D802}\1.1\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{932A5E6E-B557-40CC-9EE5-ECF147433486}\TypeLib\Version = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{725e0daf-5501-4be7-881c-144101fbea71}\Programmable regsvr32.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2920 VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe 2920 VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe 2920 VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe 2920 VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe 2920 VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe 2920 VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2920 wrote to memory of 1988 2920 VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe 84 PID 2920 wrote to memory of 1988 2920 VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe 84 PID 2920 wrote to memory of 1988 2920 VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe 84 PID 2920 wrote to memory of 472 2920 VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe 85 PID 2920 wrote to memory of 472 2920 VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe 85 PID 2920 wrote to memory of 472 2920 VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe 85 PID 472 wrote to memory of 3436 472 regsvr32.exe 86 PID 472 wrote to memory of 3436 472 regsvr32.exe 86 PID 2920 wrote to memory of 4144 2920 VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe 89 PID 2920 wrote to memory of 4144 2920 VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe 89 PID 2920 wrote to memory of 4144 2920 VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_2979570d9b6f2a7f85bef096e7fbd855.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ie\TrustMediaViewerV1alpha6001.dll" /s2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1988
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ie\TrustMediaViewerV1alpha6001x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ie\TrustMediaViewerV1alpha6001x64.dll"3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:3436
-
-
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\System32\gpupdate.exe" /force2⤵PID:4144
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:1616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:1008
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ie\TrustMediaViewerV1alpha6001.dll
- Size 85KB
- SHA256 f32b01931bf04c168bbebd1621856c5dc8632c8edf6d70d6d4b2302f1f3dad55
- MD5 3c00fa085e25db9be961ec812a61cf13
- SHA1 5229e89f266dff9f042c4ae8519f64aa69b7a522
- SHA512 44fb77026cfec61fd7ee068caee250fa44d14f69f094a84f2a58ff61c0c1bce85352413a016ec054c9bcec016ecca58a36574df5dea71ea01e602764d8f0d58c
- SSDEEP 1536:BpMGCsQis4EnvtKx+kNp8Dkbw518DOslQPNEjW1x:AGais4EnlKx+kNbw5uDraPNEjW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6001\ie\TrustMediaViewerV1alpha6001x64.dll
- Size 100KB
- SHA256 0b2627b2514690256610cf2776baf6d64dd4c1714c5024d4c6655056faec5c05
- MD5 db6233fdf6836c55cc73861084cf055e
- SHA1 916bc414e3d8df951133da589c0d63e18cfff7d9
- SHA512 8aebd7f514de579aa41e8597a13a9e1ebb143a46fa12f404fc8ce6fef34709c91e55f27cd75de58236366bb00b5e240bfaea8f0c79ed6ef886413872bc3d4243
- SSDEEP 3072:ZBjCnTZPjGSRzBHsQnTfGNAjJUSWfzQBTWNF9jZW:ZNCnTZPjGAlHdTONAjf+vd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsy757F.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsy757F.tmp\aminsis.dll
- Size 567KB
- SHA256 e78e0e61707cabec8383f1e74da9db8e0fa123a3a7b36f0080d70fbaed6f7453
- MD5 f346047b13f37f79c462e59a6319faa1
- SHA1 ce9e7cb9719000a69b463fe024c81229e322279f
- SHA512 429209cc489ba9ac2d62055b128efb3cded3e31f966c7cdb1aee592ec7a54ab090526705fa2519498d92eb4bc2efa141cd83adc6c251b793388ad1208b172167
- SSDEEP 12288:w/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9G/uf:vGnSkWh4G1ppgH81vrBu3MHOGUKfG/
- MD5 SHA1 SHA512 SSDEEP