0f4245bfb61c0323fa76f11257eaca436a8fe904f420b337f434010a5fe975d9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2fdb943f551e6c454bbe7ba53b20593.dll
Size

180KB
MD5

a2fdb943f551e6c454bbe7ba53b20593
SHA1

0fbc61952310a3d984d918a89e9b0dea9a32669f
SHA256

0f4245bfb61c0323fa76f11257eaca436a8fe904f420b337f434010a5fe975d9
SHA512

3bdf20d05c035078a33d62bf821d4b2ef9fb56492b88e158ff09985dd3f39ffc70d15622924e2b07d3eee2b05273dd6b2963963431d75a5f2d6c41c710c1d0d7
SSDEEP

3072:EfHYEdVrpA9i4w/md3sLrxoXt9LBSJCl1iZaNZE8tEbORz:iHYEdVrpA9d36o9n6MkFbO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{037E0831-A9B3-4AF9-99A7-F6A9E1E6A6D4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Toolbar	regsvr32.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{037E0831-A9B3-4AF9-99A7-F6A9E1E6A6D4}\ProgID\ = "mkrndofl.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E63BBC4-4194-4918-98F0-4F55305B186C}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a2fdb943f551e6c454bbe7ba53b20593.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CA4E8C5-EA05-46CB-9053-AF3C07CD52B1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CA4E8C5-EA05-46CB-9053-AF3C07CD52B1}\TypeLib\ = "{8E63BBC4-4194-4918-98F0-4F55305B186C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CA4E8C5-EA05-46CB-9053-AF3C07CD52B1}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CA4E8C5-EA05-46CB-9053-AF3C07CD52B1}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mkrndofl.bsvq	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mkrndofl.bsvq\ = "mkrndofl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{037E0831-A9B3-4AF9-99A7-F6A9E1E6A6D4}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{037E0831-A9B3-4AF9-99A7-F6A9E1E6A6D4}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{037E0831-A9B3-4AF9-99A7-F6A9E1E6A6D4}\TypeLib\ = "{8E63BBC4-4194-4918-98F0-4F55305B186C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CA4E8C5-EA05-46CB-9053-AF3C07CD52B1}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CA4E8C5-EA05-46CB-9053-AF3C07CD52B1}\ = "Ibsvq"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mkrndofl.ToolBar.1\ = "mkrndofl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mkrndofl.bsvq\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mkrndofl.bsvq\CurVer\ = "mkrndofl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CA4E8C5-EA05-46CB-9053-AF3C07CD52B1}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CA4E8C5-EA05-46CB-9053-AF3C07CD52B1}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mkrndofl.ToolBar.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mkrndofl.ToolBar.1\CLSID\ = "{037E0831-A9B3-4AF9-99A7-F6A9E1E6A6D4}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{037E0831-A9B3-4AF9-99A7-F6A9E1E6A6D4}\ = "mkrndofl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{037E0831-A9B3-4AF9-99A7-F6A9E1E6A6D4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a2fdb943f551e6c454bbe7ba53b20593.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CA4E8C5-EA05-46CB-9053-AF3C07CD52B1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E63BBC4-4194-4918-98F0-4F55305B186C}\1.0\ = "mkrndofl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mkrndofl.bsvq\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{037E0831-A9B3-4AF9-99A7-F6A9E1E6A6D4}\VersionIndependentProgID\ = "mkrndofl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{037E0831-A9B3-4AF9-99A7-F6A9E1E6A6D4}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{037E0831-A9B3-4AF9-99A7-F6A9E1E6A6D4}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{037E0831-A9B3-4AF9-99A7-F6A9E1E6A6D4}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E63BBC4-4194-4918-98F0-4F55305B186C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E63BBC4-4194-4918-98F0-4F55305B186C}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E63BBC4-4194-4918-98F0-4F55305B186C}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CA4E8C5-EA05-46CB-9053-AF3C07CD52B1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E63BBC4-4194-4918-98F0-4F55305B186C}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E63BBC4-4194-4918-98F0-4F55305B186C}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E63BBC4-4194-4918-98F0-4F55305B186C}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mkrndofl.ToolBar.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mkrndofl.bsvq\CLSID\ = "{037E0831-A9B3-4AF9-99A7-F6A9E1E6A6D4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{037E0831-A9B3-4AF9-99A7-F6A9E1E6A6D4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{037E0831-A9B3-4AF9-99A7-F6A9E1E6A6D4}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CA4E8C5-EA05-46CB-9053-AF3C07CD52B1}\ = "Ibsvq"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CA4E8C5-EA05-46CB-9053-AF3C07CD52B1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CA4E8C5-EA05-46CB-9053-AF3C07CD52B1}\TypeLib\ = "{8E63BBC4-4194-4918-98F0-4F55305B186C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E63BBC4-4194-4918-98F0-4F55305B186C}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E63BBC4-4194-4918-98F0-4F55305B186C}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CA4E8C5-EA05-46CB-9053-AF3C07CD52B1}\TypeLib\Version = "1.0"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 412	4240	regsvr32.exe	74
PID 4240 wrote to memory of 412	4240	regsvr32.exe	74
PID 4240 wrote to memory of 412	4240	regsvr32.exe	74

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a2fdb943f551e6c454bbe7ba53b20593.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a2fdb943f551e6c454bbe7ba53b20593.dll
  2⤵
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads