8d2f02a55a6957c8b8013d5df7837cbc836fa1e599d7d7eed4f1ef4a42f7fb8f

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SnagIt 8/DLLx64/SnagItIEAddin64.dll
Size

204KB
MD5

766954ee1b145458611924f97b9d3094
SHA1

85619e6b768b3cc2e80ea388a8d41ef2f2b37fe9
SHA256

77b954721de1dc5fdb508fdd98df0ed0563e4e72624dc581878762c6adf1311d
SHA512

de5eeb32aac8f684828371d3b5fc17620dcfb063d2dd4fb5bf69cc2efcd731134128b215289e4988eef699740a212d3a08adc771b48e307dc3ca13a1d3082c40
SSDEEP

3072:iKZ+HQDvmK1h3xa1YT/EXo8u6MU/BG2M60ui3AopJvAp1J31ZBXXCvJBA50jUO5F:iWvY/B3SUp111ZBXSj7UO5/hGB+

Score

7^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SnagIt 8\\DLLx64\\SnagItIEAddin64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{86300DD7-B136-40d9-823C-22EBD55D7858}\AppName	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{86300DD7-B136-40d9-823C-22EBD55D7858}\AppPath	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{86300DD7-B136-40d9-823C-22EBD55D7858}\Policy = "3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Toolbar	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{86300DD7-B136-40d9-823C-22EBD55D7858}	regsvr32.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6E1F29D1-BF21-425B-A313-940C87CC3E8C}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}\ = "SnagIt"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6E1F29D1-BF21-425B-A313-940C87CC3E8C}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6E1F29D1-BF21-425B-A313-940C87CC3E8C}\1.0\ = "IEAddin 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SnagIt 8\\DLLx64\\SnagItIEAddin64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SnagItIEAddin.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SnagItIEAddin.DLL\AppID = "{9D752205-8198-4F60-A0F5-6C7DEA7F2282}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9D752205-8198-4F60-A0F5-6C7DEA7F2282}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9D752205-8198-4F60-A0F5-6C7DEA7F2282}\ = "IEAddin"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6E1F29D1-BF21-425B-A313-940C87CC3E8C}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6E1F29D1-BF21-425B-A313-940C87CC3E8C}\1.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6E1F29D1-BF21-425B-A313-940C87CC3E8C}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SnagIt 8\\DLLx64\\SnagItIEAddin64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6E1F29D1-BF21-425B-A313-940C87CC3E8C}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6E1F29D1-BF21-425B-A313-940C87CC3E8C}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SnagIt 8\\DLLx64\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6E1F29D1-BF21-425B-A313-940C87CC3E8C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6E1F29D1-BF21-425B-A313-940C87CC3E8C}\1.0\FLAGS	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\SnagIt 8\DLLx64\SnagItIEAddin64.dll"
1⤵
- Registers COM server for autorun
- Modifies Internet Explorer settings
- Modifies registry class
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads