Overview
overview
8Static
static
1EasyHiderD...re.dll
windows7-x64
8EasyHiderD...re.dll
windows10-2004-x64
3EasyHiderD...ap.exe
windows7-x64
1EasyHiderD...ap.exe
windows10-2004-x64
1EasyHiderD...nu.dll
windows7-x64
6EasyHiderD...nu.dll
windows10-2004-x64
6EasyHiderD...64.dll
windows7-x64
6EasyHiderD...64.dll
windows10-2004-x64
6Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
20/02/2024, 07:33
Static task
static1
Behavioral task
behavioral1
Sample
EasyHiderData/Bin/boxstore.dll
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
EasyHiderData/Bin/boxstore.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
EasyHiderData/Bin/easywrap.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
EasyHiderData/Bin/easywrap.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
EasyHiderData/Bin/shellmenu.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
EasyHiderData/Bin/shellmenu.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
EasyHiderData/Bin/shellmenu_x64.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
EasyHiderData/Bin/shellmenu_x64.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
EasyHiderData/Bin/shellmenu_x64.dll
-
Size
1.3MB
-
MD5
aeb9c35ad419fcb750830017c6a41890
-
SHA1
b47fdcb7a18a742ea087c441c965c7b6c7494aed
-
SHA256
74b42e436b6404bfd9be62d0ee3a879cdf64158c7a45fcc14964fcbf6ab23766
-
SHA512
c2114b7e3995dbfe7eb7fe9a0f616b1c5d22608672d20569886f1c471e19608c83202376a3e521b0d03272eeae33ddb13420f269f18fd8dd274bf09c90f18254
-
SSDEEP
24576:6M81Ac979ju+VNt+1Msh/x/4dSUW6PLmw:XpU5VVvO5x/4dSH6PLmw
Score
6/10
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6} regsvr32.exe -
Registers COM server for autorun 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\InprocServer32\ = "shell32.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EasyHiderData\\Bin\\shellmenu_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\InprocServer32 regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\Shell\open regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\ShellEx\ContextMenuHandlers\easyhidershell\ = "{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\ShellFolder regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F158359-A322-4D8C-ABEA-BEF758AAFD00} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\easyhidershell\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6}\TypeLib\ = "{5f158359-a322-4d8c-abea-bef758aafd00}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\Shell regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\ShellFolder\Attributes = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6}\VersionIndependentProgID\ = "easyhidershell" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\easyhidershell.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D21FE9A1-1120-43EC-891D-3AF7CE3B92DC}\ = "Ihidershell" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D21FE9A1-1120-43EC-891D-3AF7CE3B92DC}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D21FE9A1-1120-43EC-891D-3AF7CE3B92DC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F158359-A322-4D8C-ABEA-BEF758AAFD00}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F158359-A322-4D8C-ABEA-BEF758AAFD00}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D21FE9A1-1120-43EC-891D-3AF7CE3B92DC}\ = "Ihidershell" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\ShellEx regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\ShellEx\ContextMenuHandlers regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\easyhidershell.1\ = "hidershell class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\easyhidershell regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D21FE9A1-1120-43EC-891D-3AF7CE3B92DC}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F158359-A322-4D8C-ABEA-BEF758AAFD00}\1.0\ = "shellmenuLib" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D21FE9A1-1120-43EC-891D-3AF7CE3B92DC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D21FE9A1-1120-43EC-891D-3AF7CE3B92DC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EasyHiderData\\Bin\\shellmenu_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F158359-A322-4D8C-ABEA-BEF758AAFD00}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EasyHiderData\\Bin\\shellmenu_x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\easyhidershell\CurVer\ = "easyhidershell.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\easyhidershell.1\CLSID\ = "{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\ShellEx\PropertySheetHandlers\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\ = "Îļþ±£ÏÕ¹ñ" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F158359-A322-4D8C-ABEA-BEF758AAFD00}\1.0\0\win64 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D21FE9A1-1120-43EC-891D-3AF7CE3B92DC}\TypeLib\ = "{5F158359-A322-4D8C-ABEA-BEF758AAFD00}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\easyhidershell\ = "hidershell class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D21FE9A1-1120-43EC-891D-3AF7CE3B92DC}\TypeLib\ = "{5F158359-A322-4D8C-ABEA-BEF758AAFD00}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D21FE9A1-1120-43EC-891D-3AF7CE3B92DC}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6}\ = "hidershell class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\easyhidermenu\ = "{912ce534-4e5a-4b9d-b3a8-e282ca3e87a6}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\easyhidermenu regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F158359-A322-4D8C-ABEA-BEF758AAFD00}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EasyHiderData\\Bin" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D21FE9A1-1120-43EC-891D-3AF7CE3B92DC} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D21FE9A1-1120-43EC-891D-3AF7CE3B92DC}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\System.ItemAuthors = "Ë«»÷´ò¿ª±£ÏÕ¹ñ" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EasyHiderData\\Bin\\shellmenu_x64.dll\",0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\InprocServer32\ = "shell32.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\Shell\open\Command regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\Shell\open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EasyHiderData\\Bin\\easywrap.exe\"" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F158359-A322-4D8C-ABEA-BEF758AAFD00}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D21FE9A1-1120-43EC-891D-3AF7CE3B92DC}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\easyhidershell.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA}\DefaultIcon regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D21FE9A1-1120-43EC-891D-3AF7CE3B92DC}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF6C7A4A-FD09-4757-9D69-29C0F56845DA} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F158359-A322-4D8C-ABEA-BEF758AAFD00}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F158359-A322-4D8C-ABEA-BEF758AAFD00}\1.0\HELPDIR regsvr32.exe