Analysis
- max time kernel
93s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/03/2024, 06:38
Behavioral task
behavioral1
Sample
b175b25f516de2cc5b469dc3f4d2545b.dll
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
b175b25f516de2cc5b469dc3f4d2545b.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target b175b25f516de2cc5b469dc3f4d2545b.dll
- Size 745KB
- Sample240304-hedr9scc2s
- SHA256 ace4756379430cfd862d8d62bbda57a0c47fc16c884872f081eec1bf1c3e3242
- MD5 b175b25f516de2cc5b469dc3f4d2545b
- SHA1 c8093ad0fe44b9bc14f08e2c526eebc1ba236a85
- SHA512 1d1bffeebcca326acb6ad00cd6d08ee69f445158cdca5fba37e02e3a67e2e3e5594ed8d7176a7a2c0a08433e652fbb4e60c9a8d60bde4cc4520b661bad191209
- SSDEEP 12288:pf1CqS5HpFgoH7vvUaPOyjFlDZ7N3YT1hT9YKx0b0oCFoWx78U0nKqovpD4pjQ:pf1JS5HngogaPO2FlNEL9ByNYd78lKNR
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gbieh.a = "rundll32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\b175b25f516de2cc5b469dc3f4d2545b.dll\" SpecialFunction" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gbieh.b = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\gbppsv.exe\"" regsvr32.exe - Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}\ = "Banco do Brasil S.A." regsvr32.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b175b25f516de2cc5b469dc3f4d2545b.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}\ = "GbiehObj Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}\ regsvr32.exe - Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3720 regsvr32.exe Token: SeSecurityPrivilege 3720 regsvr32.exe Token: SeTakeOwnershipPrivilege 3720 regsvr32.exe Token: SeLoadDriverPrivilege 3720 regsvr32.exe Token: SeSystemProfilePrivilege 3720 regsvr32.exe Token: SeSystemtimePrivilege 3720 regsvr32.exe Token: SeProfSingleProcessPrivilege 3720 regsvr32.exe Token: SeIncBasePriorityPrivilege 3720 regsvr32.exe Token: SeCreatePagefilePrivilege 3720 regsvr32.exe Token: SeShutdownPrivilege 3720 regsvr32.exe Token: SeDebugPrivilege 3720 regsvr32.exe Token: SeSystemEnvironmentPrivilege 3720 regsvr32.exe Token: SeRemoteShutdownPrivilege 3720 regsvr32.exe Token: SeUndockPrivilege 3720 regsvr32.exe Token: SeManageVolumePrivilege 3720 regsvr32.exe Token: 33 3720 regsvr32.exe Token: 34 3720 regsvr32.exe Token: 35 3720 regsvr32.exe Token: 36 3720 regsvr32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5088 wrote to memory of 3720 5088 regsvr32.exe 87 PID 5088 wrote to memory of 3720 5088 regsvr32.exe 87 PID 5088 wrote to memory of 3720 5088 regsvr32.exe 87
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\b175b25f516de2cc5b469dc3f4d2545b.dll1⤵
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\b175b25f516de2cc5b469dc3f4d2545b.dll2⤵
- Adds policy Run key to start application
- Installs/modifies Browser Helper Object
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3720
-