Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-02-2024 11:22
Behavioral task
behavioral1
Sample
a3a71f7ab30e29aa3b35e25737660219.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
a3a71f7ab30e29aa3b35e25737660219.dll
-
Size
26KB
-
MD5
a3a71f7ab30e29aa3b35e25737660219
-
SHA1
df94f425cb83cb7227dd68f1a8f965fef343935c
-
SHA256
5e5fddeb89e6eb584b359d64f4a31500c857ecf5f40d3c9852edf14ecc4b80df
-
SHA512
d03d0024245ba63b2cc5e4abbf9fd652d9a94f03dbedf9e3b592df2a8cf5b9c9f6d631c18af5a6453f24f884a7e03bc81330cbb706e1541038b1da418ca4d44e
-
SSDEEP
384:XpU1YgxxTzbcjGAUL9/c4z5GcoLHcQpGWEf6DEBug3Vk:5+YgxxTPsU1c4dK7/w6oC
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1872-0-0x0000000010000000-0x0000000010018000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1C1B8A44-61FE-411E-8F33-813A4E2E2984} regsvr32.exe -
Modifies registry class 60 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CurVer\ = "BhoNew.Bho.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\ = "AVG Safe Search" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\ = "IBho" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho.1\CLSID\ = "{1C1B8A44-61FE-411E-8F33-813A4E2E2984}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\ = "Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho.1\ = "AVG Safe Search" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CLSID\ = "{1C1B8A44-61FE-411E-8F33-813A4E2E2984}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\ = "_IBhoEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\ = "_IBhoEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a3a71f7ab30e29aa3b35e25737660219.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\ = "AVG Safe Search" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\ProgID\ = "BhoNew.Bho.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\A3A71F~1.DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\VersionIndependentProgID\ = "BhoNew.Bho" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C1B8A44-61FE-411E-8F33-813A4E2E2984} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4937D5D1-2039-409A-BD83-FEC9B39B2356}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAF9D798-C659-4B9B-8E19-EE27C3D04EE7}\ = "IBho" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\HELPDIR regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2084 wrote to memory of 1872 2084 regsvr32.exe regsvr32.exe PID 2084 wrote to memory of 1872 2084 regsvr32.exe regsvr32.exe PID 2084 wrote to memory of 1872 2084 regsvr32.exe regsvr32.exe PID 2084 wrote to memory of 1872 2084 regsvr32.exe regsvr32.exe PID 2084 wrote to memory of 1872 2084 regsvr32.exe regsvr32.exe PID 2084 wrote to memory of 1872 2084 regsvr32.exe regsvr32.exe PID 2084 wrote to memory of 1872 2084 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a3a71f7ab30e29aa3b35e25737660219.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\a3a71f7ab30e29aa3b35e25737660219.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1872-0-0x0000000010000000-0x0000000010018000-memory.dmpFilesize
96KB