Analysis
- max time kernel
146s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/03/2024, 11:54
Behavioral task
behavioral1
Sample
b20f37343fe8834bfdf187a566ddf0f2.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
- Target b20f37343fe8834bfdf187a566ddf0f2.dll
- Size 754KB
- Sample240304-n3csrsaf99
- SHA256 bbe5a27ea26f19777cccc1eb816ed3f8135e17c7851680b69cb94c37d7f1871f
- MD5 b20f37343fe8834bfdf187a566ddf0f2
- SHA1 592b1334735678bc580f8c6a7dc658db34b027ec
- SHA512 c0be180c37a9366ca84eba9db3d99e43ad5fe7b500d743c745a049137954b16b06d7ea0e436fb96417c4327c6cf0bbc75d13de9aac2615ec0baec540e95eb2bc
- SSDEEP 12288:BJnPucNc6dnIwfSl9erLoQoAUx9SIt3AfVmi62Xr3SgyXIKcOzN+IldpxvhvviFD:znPPhdnIkSurLQZ5cmi62XZKcyrpxvhq
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}\ = "Banco do Brasil S.A." regsvr32.exe - Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}\ = "GbiehObj Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b20f37343fe8834bfdf187a566ddf0f2.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAAAC14-BC46-40CA-9CB2-CBB12C6739EB}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe - Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2752 regsvr32.exe Token: SeSecurityPrivilege 2752 regsvr32.exe Token: SeTakeOwnershipPrivilege 2752 regsvr32.exe Token: SeLoadDriverPrivilege 2752 regsvr32.exe Token: SeSystemProfilePrivilege 2752 regsvr32.exe Token: SeSystemtimePrivilege 2752 regsvr32.exe Token: SeProfSingleProcessPrivilege 2752 regsvr32.exe Token: SeIncBasePriorityPrivilege 2752 regsvr32.exe Token: SeCreatePagefilePrivilege 2752 regsvr32.exe Token: SeShutdownPrivilege 2752 regsvr32.exe Token: SeDebugPrivilege 2752 regsvr32.exe Token: SeSystemEnvironmentPrivilege 2752 regsvr32.exe Token: SeRemoteShutdownPrivilege 2752 regsvr32.exe Token: SeUndockPrivilege 2752 regsvr32.exe Token: SeManageVolumePrivilege 2752 regsvr32.exe Token: 33 2752 regsvr32.exe Token: 34 2752 regsvr32.exe Token: 35 2752 regsvr32.exe Token: 36 2752 regsvr32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 392 wrote to memory of 2752 392 regsvr32.exe 86 PID 392 wrote to memory of 2752 392 regsvr32.exe 86 PID 392 wrote to memory of 2752 392 regsvr32.exe 86
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\b20f37343fe8834bfdf187a566ddf0f2.dll1⤵
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\b20f37343fe8834bfdf187a566ddf0f2.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2752
-