Overview
overview
7Static
static
3SnagIt 8/2...D8.dll
windows7-x64
1SnagIt 8/2...D8.dll
windows10-2004-x64
SnagIt 8/A...er.dll
windows7-x64
1SnagIt 8/A...er.dll
windows10-2004-x64
1SnagIt 8/D...64.dll
windows7-x64
7SnagIt 8/D...64.dll
windows10-2004-x64
7SnagIt 8/D...64.dll
windows7-x64
7SnagIt 8/D...64.dll
windows10-2004-x64
7SnagIt 8/D...64.dll
windows7-x64
1SnagIt 8/D...64.dll
windows10-2004-x64
1SnagIt 8/D...64.dll
windows7-x64
7SnagIt 8/D...64.dll
windows10-2004-x64
7SnagIt 8/D...80.dll
windows7-x64
1SnagIt 8/D...80.dll
windows10-2004-x64
1SnagIt 8/D...80.dll
windows7-x64
1SnagIt 8/D...80.dll
windows10-2004-x64
1SnagIt 8/LFCMP12n.dll
windows7-x64
1SnagIt 8/LFCMP12n.dll
windows10-2004-x64
1SnagIt 8/LTDIS12n.dll
windows7-x64
1SnagIt 8/LTDIS12n.dll
windows10-2004-x64
1SnagIt 8/LTSCR12n.dll
windows7-x64
1SnagIt 8/LTSCR12n.dll
windows10-2004-x64
1SnagIt 8/Lfpct12n.dll
windows7-x64
1SnagIt 8/Lfpct12n.dll
windows10-2004-x64
1SnagIt 8/Lfpng12n.dll
windows7-x64
1SnagIt 8/Lfpng12n.dll
windows10-2004-x64
1SnagIt 8/Lfwmf12n.dll
windows7-x64
1SnagIt 8/Lfwmf12n.dll
windows10-2004-x64
1SnagIt 8/MFC80CHS.dll
windows7-x64
1SnagIt 8/MFC80CHS.dll
windows10-2004-x64
1SnagIt 8/MFC80CHT.dll
windows7-x64
1SnagIt 8/MFC80CHT.dll
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/03/2024, 05:17
Static task
static1
Behavioral task
behavioral1
Sample
SnagIt 8/2KXP/SNAGITD8.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
SnagIt 8/2KXP/SNAGITD8.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
SnagIt 8/AccessoryInstaller.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
SnagIt 8/AccessoryInstaller.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
SnagIt 8/DLLx64/SnagItBHO64.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
SnagIt 8/DLLx64/SnagItBHO64.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
SnagIt 8/DLLx64/SnagItIEAddin64.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
SnagIt 8/DLLx64/SnagItIEAddin64.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
SnagIt 8/DLLx64/SnagItIEAddinRes64.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
SnagIt 8/DLLx64/SnagItIEAddinRes64.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
SnagIt 8/DLLx64/SnagItShellExt64.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
SnagIt 8/DLLx64/SnagItShellExt64.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
SnagIt 8/DLLx64/msvcp80.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
SnagIt 8/DLLx64/msvcp80.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
SnagIt 8/DLLx64/msvcr80.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral16
Sample
SnagIt 8/DLLx64/msvcr80.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
SnagIt 8/LFCMP12n.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
SnagIt 8/LFCMP12n.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
SnagIt 8/LTDIS12n.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
SnagIt 8/LTDIS12n.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
SnagIt 8/LTSCR12n.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
SnagIt 8/LTSCR12n.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
SnagIt 8/Lfpct12n.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
SnagIt 8/Lfpct12n.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
SnagIt 8/Lfpng12n.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral26
Sample
SnagIt 8/Lfpng12n.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
SnagIt 8/Lfwmf12n.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral28
Sample
SnagIt 8/Lfwmf12n.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
SnagIt 8/MFC80CHS.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
SnagIt 8/MFC80CHS.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
SnagIt 8/MFC80CHT.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral32
Sample
SnagIt 8/MFC80CHT.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
SnagIt 8/DLLx64/SnagItShellExt64.dll
-
Size
362KB
-
MD5
6312df206e105a00d333d37601d31adc
-
SHA1
9e3f7557f21bcd7742ca102e82f0765226c81e52
-
SHA256
a4579f6a37ed40ec6a162af3df6c5b47690615feff629de37226263115e3f250
-
SHA512
d5fbd92bf794ca0ecb28dc7c1b52cf8425f272b5b1cff06c3eb5070b4b35098ecda9712d60fcb3fe3be7b6ace9e272fbf53848a55bb7d5391cdd9b3a42b9bee9
-
SSDEEP
3072:nBDN4cFmkuRmTO9PkwIwUupMUzofbsXY0zx4lRqekCK+5XcbIqNGngerCdTd8XZx:BDN4dGOwvnw36XcsyCCdT6XZO25ljToc
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF74B903-3389-469c-B3B6-0204D204FCBD}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF74B903-3389-469c-B3B6-0204D204FCBD}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SnagIt 8\\DLLx64\\SnagItShellExt64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF74B903-3389-469c-B3B6-0204D204FCBD}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Modifies registry class 54 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF74B903-3389-469c-B3B6-0204D204FCBD}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF74B903-3389-469c-B3B6-0204D204FCBD}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF74B903-3389-469c-B3B6-0204D204FCBD}\TypeLib\ = "{CF74B903-3389-469c-B3B6-0204D204FCBD}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CF74B905-3389-469C-B3B6-0204D204FCBD} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF74B905-3389-469C-B3B6-0204D204FCBD}\ = "ISnagItShellExt" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CF74B905-3389-469C-B3B6-0204D204FCBD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF74B903-3389-469c-B3B6-0204D204FCBD}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SnagItMainShellExt\ = "{CF74B903-3389-469c-B3B6-0204D204FCBD}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CF74B904-3389-469C-B3B6-0204D204FCBD}\1.0\0\win64 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CF74B904-3389-469C-B3B6-0204D204FCBD}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SnagIt 8\\DLLx64\\SnagItShellExt64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SnagIt.MainShellExt.1\ = "SnagIt Shell Extension" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SnagIt.MainShellExt.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SnagIt.MainShellExt.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF74B903-3389-469c-B3B6-0204D204FCBD}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SnagIt 8\\DLLx64\\SnagItShellExt64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CF74B904-3389-469C-B3B6-0204D204FCBD}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF74B905-3389-469C-B3B6-0204D204FCBD}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SnagIt.MainShellExt\ = "SnagIt Shell Extension" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF74B903-3389-469c-B3B6-0204D204FCBD}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\SnagItMainShellExt\ = "{CF74B903-3389-469c-B3B6-0204D204FCBD}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CF74B905-3389-469C-B3B6-0204D204FCBD}\TypeLib\ = "{CF74B904-3389-469C-B3B6-0204D204FCBD}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CF74B904-3389-469C-B3B6-0204D204FCBD} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CF74B905-3389-469C-B3B6-0204D204FCBD}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF74B905-3389-469C-B3B6-0204D204FCBD}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CF74B905-3389-469C-B3B6-0204D204FCBD}\ = "ISnagItShellExt" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SnagIt.MainShellExt\CLSID\ = "{CF74B903-3389-469c-B3B6-0204D204FCBD}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SnagIt.MainShellExt\CurVer\ = "SnagIt.BatchConvert.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\SnagItMainShellExt regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF74B905-3389-469C-B3B6-0204D204FCBD} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SnagItShellExt.DLL regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF74B903-3389-469c-B3B6-0204D204FCBD}\VersionIndependentProgID\ = "SnagIt.MainShellExt" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{37AD3083-3787-41DC-944D-32CDEECFDB75} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CF74B904-3389-469C-B3B6-0204D204FCBD}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SnagIt 8\\DLLx64\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CF74B904-3389-469C-B3B6-0204D204FCBD}\1.0\ = "SnagItShellExt 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CF74B904-3389-469C-B3B6-0204D204FCBD}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF74B905-3389-469C-B3B6-0204D204FCBD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CF74B905-3389-469C-B3B6-0204D204FCBD}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SnagItShellExt.DLL\AppID = "{37AD3083-3787-41DC-944D-32CDEECFDB75}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SnagIt.MainShellExt\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF74B903-3389-469c-B3B6-0204D204FCBD}\ = "SnagItShellExt Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF74B903-3389-469c-B3B6-0204D204FCBD}\ProgID\ = "SnagIt.MainShellExt.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SnagIt.MainShellExt.1\CLSID\ = "{CF74B903-3389-469c-B3B6-0204D204FCBD}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF74B903-3389-469c-B3B6-0204D204FCBD}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CF74B904-3389-469C-B3B6-0204D204FCBD}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CF74B905-3389-469C-B3B6-0204D204FCBD}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SnagIt.MainShellExt regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CF74B904-3389-469C-B3B6-0204D204FCBD}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{37AD3083-3787-41DC-944D-32CDEECFDB75}\ = "SnagItShellExt" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF74B903-3389-469c-B3B6-0204D204FCBD} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF74B903-3389-469c-B3B6-0204D204FCBD}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF74B905-3389-469C-B3B6-0204D204FCBD}\TypeLib\ = "{CF74B904-3389-469C-B3B6-0204D204FCBD}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SnagIt.MainShellExt\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SnagItMainShellExt regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CF74B904-3389-469C-B3B6-0204D204FCBD}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF74B905-3389-469C-B3B6-0204D204FCBD}\TypeLib\Version = "1.0" regsvr32.exe