Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-03-2024 13:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbbeab8beec2aeade9091b825a8600ce.dll
Resource
win7-20240221-en
3 signatures
150 seconds
General
-
Target
dbbeab8beec2aeade9091b825a8600ce.dll
-
Size
564KB
-
MD5
dbbeab8beec2aeade9091b825a8600ce
-
SHA1
9c870ff9cc4a642c1a724abffb028c9fdad35aa6
-
SHA256
d1eb2c897db3ec33c7f74df96de1f18dacece9004aa20f42b381f88d0391cec2
-
SHA512
9e78fe2e4e46e66ee9702d0a3635465bd9bab130178b02f5251abfbd066879509ba76ca6ec96976b46f3b0badc5525c3228c9918dc177e8400a473a9812f0cb4
-
SSDEEP
12288:m0Et9YDc/Tk4Po4wSSqodPF9C2vTgYkcOS+O5YM48:2tWDcw4o4Ts/9Ckku+O5Z4
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{CC01FC6C-1E61-D879-B74C-4F4CEB3F277F} regsvr32.exe -
Modifies registry class 11 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-1E61-D879-B74C-4F4CEB3F277F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dbbeab8beec2aeade9091b825a8600ce.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-1E61-D879-B74C-4F4CEB3F277F}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dbbeab8beec2aeade9091b825a8600ce.sh regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-1E61-D879-B74C-4F4CEB3F277F}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-1E61-D879-B74C-4F4CEB3F277F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-1E61-D879-B74C-4F4CEB3F277F}\ = "sh" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-1E61-D879-B74C-4F4CEB3F277F}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CC01FC6C-1E61-D879-B74C-4F4CEB3F277F}\ProgID\ = "dbbeab8beec2aeade9091b825a8600ce.sh" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dbbeab8beec2aeade9091b825a8600ce.sh\ = "sh" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dbbeab8beec2aeade9091b825a8600ce.sh\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dbbeab8beec2aeade9091b825a8600ce.sh\Clsid\ = "{CC01FC6C-1E61-D879-B74C-4F4CEB3F277F}" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2176 wrote to memory of 1832 2176 regsvr32.exe 28 PID 2176 wrote to memory of 1832 2176 regsvr32.exe 28 PID 2176 wrote to memory of 1832 2176 regsvr32.exe 28 PID 2176 wrote to memory of 1832 2176 regsvr32.exe 28 PID 2176 wrote to memory of 1832 2176 regsvr32.exe 28 PID 2176 wrote to memory of 1832 2176 regsvr32.exe 28 PID 2176 wrote to memory of 1832 2176 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\dbbeab8beec2aeade9091b825a8600ce.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\dbbeab8beec2aeade9091b825a8600ce.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1832
-