Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
21-03-2024 18:01
Behavioral task
behavioral1
Sample
dc444ad33b8902a32a733b37e7fe63f1.dll
Resource
win7-20240220-en
4 signatures
150 seconds
General
-
Target
dc444ad33b8902a32a733b37e7fe63f1.dll
-
Size
556KB
-
MD5
dc444ad33b8902a32a733b37e7fe63f1
-
SHA1
447c9406314520914478aecf836d5f2880c46b5b
-
SHA256
1ae3ab46cbff2777115e5026a1066d48edef9b2e2bec30a9e5a9507d7e7f4c8a
-
SHA512
176c41251d764b9e590b6fd4aed62068504d7ed5c5889da1836244be0740fd8a0940050c0338c1458ff81bf2c03de9deb044487acc16a02214c5e32d038b24c1
-
SSDEEP
12288:mQbIiJRNZEg9mgLQamuAZ4NsWLlNrUVFuOL/CE888888888888W88888888888yc:PfZN9ca9nNvD2AdW1HGK/
Score
6/10
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EFDB823E-2483-4203-A6EB-50F66303C5BA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EFDB823E-2483-4203-A6EB-50F66303C5BA}\ regsvr32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 regsvr32.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dc444ad33b8902a32a733b37e7fe63f1.Q\Clsid\ = "{EFDB823E-2483-4203-A6EB-50F66303C5BA}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EFDB823E-2483-4203-A6EB-50F66303C5BA}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EFDB823E-2483-4203-A6EB-50F66303C5BA}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dc444ad33b8902a32a733b37e7fe63f1.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dc444ad33b8902a32a733b37e7fe63f1.Q\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EFDB823E-2483-4203-A6EB-50F66303C5BA}\ProgID\ = "dc444ad33b8902a32a733b37e7fe63f1.Q" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EFDB823E-2483-4203-A6EB-50F66303C5BA}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EFDB823E-2483-4203-A6EB-50F66303C5BA}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dc444ad33b8902a32a733b37e7fe63f1.Q regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EFDB823E-2483-4203-A6EB-50F66303C5BA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EFDB823E-2483-4203-A6EB-50F66303C5BA}\ = "S" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dc444ad33b8902a32a733b37e7fe63f1.Q\ = "S" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1204 2368 regsvr32.exe 28 PID 2368 wrote to memory of 1204 2368 regsvr32.exe 28 PID 2368 wrote to memory of 1204 2368 regsvr32.exe 28 PID 2368 wrote to memory of 1204 2368 regsvr32.exe 28 PID 2368 wrote to memory of 1204 2368 regsvr32.exe 28 PID 2368 wrote to memory of 1204 2368 regsvr32.exe 28 PID 2368 wrote to memory of 1204 2368 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\dc444ad33b8902a32a733b37e7fe63f1.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\dc444ad33b8902a32a733b37e7fe63f1.dll2⤵
- Installs/modifies Browser Helper Object
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:1204
-