Analysis

  • max time kernel
    146s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-03-2024 13:25

General

  • Target

    dbbb9485554603a6289d6bbcfcbed55b.dll

  • Size

    607KB

  • MD5

    dbbb9485554603a6289d6bbcfcbed55b

  • SHA1

    330d4ebf0019a1b43f834aafa06bdffcfcaaead8

  • SHA256

    58306f8a3500892d626b9d23c1f9fec2c33bfebd8e1063f00fd8c07beec50182

  • SHA512

    0b5340ce32acbbc43e8c0718b08dd1bd0b05e77836d2efb405fd6a19f5f99ff91fc255857846f9071ddacdd9caf3b6e4cc12fcd4ab74b8b1c8612af09eda5f28

  • SSDEEP

    12288:SpIt9HX65cspWkY5DARyLuaIg3Qao+rRmAuET2u00/:SetFXsoB7LGnao+rcAupu00

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies registry class 11 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dbbb9485554603a6289d6bbcfcbed55b.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3972
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\dbbb9485554603a6289d6bbcfcbed55b.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      PID:3840
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4528 --field-trial-handle=2320,i,3025503729105798828,9325691672526736153,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3400

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3840-0-0x00000000006B0000-0x000000000074D000-memory.dmp

      Filesize

      628KB