Overview
overview
7Static
static
3SnagIt 8/2...D8.dll
windows7-x64
1SnagIt 8/2...D8.dll
windows10-2004-x64
SnagIt 8/A...er.dll
windows7-x64
1SnagIt 8/A...er.dll
windows10-2004-x64
1SnagIt 8/D...64.dll
windows7-x64
7SnagIt 8/D...64.dll
windows10-2004-x64
7SnagIt 8/D...64.dll
windows7-x64
7SnagIt 8/D...64.dll
windows10-2004-x64
7SnagIt 8/D...64.dll
windows7-x64
1SnagIt 8/D...64.dll
windows10-2004-x64
1SnagIt 8/D...64.dll
windows7-x64
7SnagIt 8/D...64.dll
windows10-2004-x64
7SnagIt 8/D...80.dll
windows7-x64
1SnagIt 8/D...80.dll
windows10-2004-x64
1SnagIt 8/D...80.dll
windows7-x64
1SnagIt 8/D...80.dll
windows10-2004-x64
1SnagIt 8/LFCMP12n.dll
windows7-x64
1SnagIt 8/LFCMP12n.dll
windows10-2004-x64
1SnagIt 8/LTDIS12n.dll
windows7-x64
1SnagIt 8/LTDIS12n.dll
windows10-2004-x64
1SnagIt 8/LTSCR12n.dll
windows7-x64
1SnagIt 8/LTSCR12n.dll
windows10-2004-x64
1SnagIt 8/Lfpct12n.dll
windows7-x64
1SnagIt 8/Lfpct12n.dll
windows10-2004-x64
1SnagIt 8/Lfpng12n.dll
windows7-x64
1SnagIt 8/Lfpng12n.dll
windows10-2004-x64
1SnagIt 8/Lfwmf12n.dll
windows7-x64
1SnagIt 8/Lfwmf12n.dll
windows10-2004-x64
1SnagIt 8/MFC80CHS.dll
windows7-x64
1SnagIt 8/MFC80CHS.dll
windows10-2004-x64
1SnagIt 8/MFC80CHT.dll
windows7-x64
1SnagIt 8/MFC80CHT.dll
windows10-2004-x64
1Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-03-2024 05:17
Static task
static1
Behavioral task
behavioral1
Sample
SnagIt 8/2KXP/SNAGITD8.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
SnagIt 8/2KXP/SNAGITD8.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
SnagIt 8/AccessoryInstaller.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
SnagIt 8/AccessoryInstaller.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
SnagIt 8/DLLx64/SnagItBHO64.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
SnagIt 8/DLLx64/SnagItBHO64.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
SnagIt 8/DLLx64/SnagItIEAddin64.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
SnagIt 8/DLLx64/SnagItIEAddin64.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
SnagIt 8/DLLx64/SnagItIEAddinRes64.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
SnagIt 8/DLLx64/SnagItIEAddinRes64.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
SnagIt 8/DLLx64/SnagItShellExt64.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
SnagIt 8/DLLx64/SnagItShellExt64.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
SnagIt 8/DLLx64/msvcp80.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
SnagIt 8/DLLx64/msvcp80.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
SnagIt 8/DLLx64/msvcr80.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral16
Sample
SnagIt 8/DLLx64/msvcr80.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
SnagIt 8/LFCMP12n.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
SnagIt 8/LFCMP12n.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
SnagIt 8/LTDIS12n.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
SnagIt 8/LTDIS12n.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
SnagIt 8/LTSCR12n.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
SnagIt 8/LTSCR12n.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
SnagIt 8/Lfpct12n.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
SnagIt 8/Lfpct12n.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
SnagIt 8/Lfpng12n.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral26
Sample
SnagIt 8/Lfpng12n.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
SnagIt 8/Lfwmf12n.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral28
Sample
SnagIt 8/Lfwmf12n.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
SnagIt 8/MFC80CHS.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
SnagIt 8/MFC80CHS.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
SnagIt 8/MFC80CHT.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral32
Sample
SnagIt 8/MFC80CHT.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
SnagIt 8/DLLx64/SnagItBHO64.dll
-
Size
63KB
-
MD5
cdbe6d64457b58149c61cd2bf2ddd9f3
-
SHA1
91b93808d6c5415a70833e5f873b01e4c1b578e5
-
SHA256
83307e40b3a5c635b81edbbb133472014f9113923c3ef5680cfe9378a950efed
-
SHA512
f0044cded05cf946cc891b76210c71bba1ca2c0f9990c9ab7d5b37531eec6fb852c0cdda144cec8f523a71cf6d9e9e62a8c45b1af730149fa6ba997592eb5a50
-
SSDEEP
768:RQIK2kxllsXGqG9b/5qW6AtA0zDA8z890tRancqdoZq2nXioO520euvgD+2L3CbC:JkTllqG9b/gFyDDhPoqr1O524oD+22C
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SnagIt 8\\DLLx64\\SnagItBHO64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00C6482D-C502-44C8-8409-FCE54AD9C208} regsvr32.exe -
Modifies registry class 51 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36D93838-4DE1-4B00-882D-31E148F386DF}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208}\ = "SnagIt Toolbar Loader" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{39CAFD20-BAFF-454D-A94C-7115710AE6E3} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36D93838-4DE1-4B00-882D-31E148F386DF}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{39CAFD20-BAFF-454D-A94C-7115710AE6E3}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{39CAFD20-BAFF-454D-A94C-7115710AE6E3}\1.0\0\win64 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36D93838-4DE1-4B00-882D-31E148F386DF}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36D93838-4DE1-4B00-882D-31E148F386DF}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36D93838-4DE1-4B00-882D-31E148F386DF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36D93838-4DE1-4B00-882D-31E148F386DF}\TypeLib\ = "{39CAFD20-BAFF-454D-A94C-7115710AE6E3}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.HelperObject.1\ = "SnagIt Toolbar Loader" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208}\VersionIndependentProgID\ = "BHO.HelperObject" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{39CAFD20-BAFF-454D-A94C-7115710AE6E3}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.HelperObject.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.HelperObject.1\CLSID\ = "{00C6482D-C502-44C8-8409-FCE54AD9C208}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36D93838-4DE1-4B00-882D-31E148F386DF} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{59AEAD8A-6822-4794-AF2E-8CC27312E26E}\ = "BHO" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.HelperObject\ = "SnagIt Toolbar Loader" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208}\AppID = "{59AEAD8A-6822-4794-AF2E-8CC27312E26E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.HelperObject.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SnagIt 8\\DLLx64\\SnagItBHO64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36D93838-4DE1-4B00-882D-31E148F386DF}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{39CAFD20-BAFF-454D-A94C-7115710AE6E3}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SnagIt 8\\DLLx64\\SnagItBHO64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{39CAFD20-BAFF-454D-A94C-7115710AE6E3}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SnagIt 8\\DLLx64\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.HelperObject regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208}\ProgID\ = "BHO.HelperObject.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{39CAFD20-BAFF-454D-A94C-7115710AE6E3}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{39CAFD20-BAFF-454D-A94C-7115710AE6E3}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{59AEAD8A-6822-4794-AF2E-8CC27312E26E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.HelperObject\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.HelperObject\CLSID\ = "{00C6482D-C502-44C8-8409-FCE54AD9C208}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208}\TypeLib\ = "{39CAFD20-BAFF-454D-A94C-7115710AE6E3}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36D93838-4DE1-4B00-882D-31E148F386DF}\ = "IHelperObject" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\BHO.DLL\AppID = "{59AEAD8A-6822-4794-AF2E-8CC27312E26E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.HelperObject\CurVer\ = "BHO.HelperObject.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36D93838-4DE1-4B00-882D-31E148F386DF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.HelperObject\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36D93838-4DE1-4B00-882D-31E148F386DF}\ = "IHelperObject" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36D93838-4DE1-4B00-882D-31E148F386DF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36D93838-4DE1-4B00-882D-31E148F386DF}\TypeLib\ = "{39CAFD20-BAFF-454D-A94C-7115710AE6E3}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36D93838-4DE1-4B00-882D-31E148F386DF}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\BHO.DLL regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{39CAFD20-BAFF-454D-A94C-7115710AE6E3}\1.0\ = "BHO 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{39CAFD20-BAFF-454D-A94C-7115710AE6E3}\1.0\HELPDIR regsvr32.exe