Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
21-03-2024 18:41
Behavioral task
behavioral1
Sample
dc57ac7a27d6c22a8808169c53934254.dll
Resource
win7-20240220-en
4 signatures
150 seconds
General
-
Target
dc57ac7a27d6c22a8808169c53934254.dll
-
Size
71KB
-
MD5
dc57ac7a27d6c22a8808169c53934254
-
SHA1
e52fbced379726a057d75d3f296c19b434e9bf38
-
SHA256
873c0d3e7a72397ec6d78df4984413fcce9357d01336d7b7e689a8c122111606
-
SHA512
752a479be6e7e96f06b3bf018e0114830098b520dad7f7433b50c57b0105accc3f3bbdf149a5d2f944dd2a264f13a51ea35310fce374557c355b54f9206a134b
-
SSDEEP
1536:hzqN73vzFuToFeZ1MHE3KGlnx1A7KHM26Iizhr:UNjvzFuTYeX0E6GN47CZ6Iyx
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2348-0-0x0000000010000000-0x0000000010036000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FFFFEECE-FF18-8222-2FB0-2935B9EA0830} regsvr32.exe -
Modifies registry class 42 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\urlmon.urlmon.1\ = "urlmon Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFEECE-FF18-8222-2FB0-2935B9EA0830}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFFFEECE-FF18-8222-2FB0-2935B9EA0831}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFFFEECE-FF18-8222-2FB0-2935B9EA0832}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFFFEECE-FF18-8222-2FB0-2935B9EA0832}\ = "IIEHlprObj" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFFFEECE-FF18-8222-2FB0-2935B9EA0832}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\urlmon.urlmon.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFEECE-FF18-8222-2FB0-2935B9EA0830}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFFFEECE-FF18-8222-2FB0-2935B9EA0831} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFFFEECE-FF18-8222-2FB0-2935B9EA0831}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFFFEECE-FF18-8222-2FB0-2935B9EA0832}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFFFEECE-FF18-8222-2FB0-2935B9EA0832}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFFFEECE-FF18-8222-2FB0-2935B9EA0831}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFFFEECE-FF18-8222-2FB0-2935B9EA0831}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFFFEECE-FF18-8222-2FB0-2935B9EA0831}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFFFEECE-FF18-8222-2FB0-2935B9EA0832} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFFFEECE-FF18-8222-2FB0-2935B9EA0832}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\urlmon.urlmon\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFEECE-FF18-8222-2FB0-2935B9EA0830}\ = "urlmon Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFEECE-FF18-8222-2FB0-2935B9EA0830}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFEECE-FF18-8222-2FB0-2935B9EA0830}\ProgID\ = "urlmon.urlmon.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFFFEECE-FF18-8222-2FB0-2935B9EA0832} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFFFEECE-FF18-8222-2FB0-2935B9EA0832}\TypeLib\ = "{FFFFEECE-FF18-8222-2FB0-2935B9EA0831}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFFFEECE-FF18-8222-2FB0-2935B9EA0831}\1.0\ = "urlmon 1.0 Library Type" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFFFEECE-FF18-8222-2FB0-2935B9EA0831}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFFFEECE-FF18-8222-2FB0-2935B9EA0832}\TypeLib\ = "{FFFFEECE-FF18-8222-2FB0-2935B9EA0831}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFFFEECE-FF18-8222-2FB0-2935B9EA0832}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFFFEECE-FF18-8222-2FB0-2935B9EA0831}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\urlmon.urlmon.1\CLSID\ = "{FFFFEECE-FF18-8222-2FB0-2935B9EA0830}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\urlmon.urlmon regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\urlmon.urlmon\CurVer\ = "urlmon.urlmon.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFEECE-FF18-8222-2FB0-2935B9EA0830} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFEECE-FF18-8222-2FB0-2935B9EA0830}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DC57AC~1.DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFEECE-FF18-8222-2FB0-2935B9EA0830}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFEECE-FF18-8222-2FB0-2935B9EA0830}\VersionIndependentProgID\ = "urlmon.urlmon" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFFFEECE-FF18-8222-2FB0-2935B9EA0831}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dc57ac7a27d6c22a8808169c53934254.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFFFEECE-FF18-8222-2FB0-2935B9EA0832}\ = "IIEHlprObj" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFFFEECE-FF18-8222-2FB0-2935B9EA0832}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\urlmon.urlmon.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\urlmon.urlmon\ = "urlmon Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFEECE-FF18-8222-2FB0-2935B9EA0830}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFFFEECE-FF18-8222-2FB0-2935B9EA0832}\TypeLib regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2348 2176 regsvr32.exe 28 PID 2176 wrote to memory of 2348 2176 regsvr32.exe 28 PID 2176 wrote to memory of 2348 2176 regsvr32.exe 28 PID 2176 wrote to memory of 2348 2176 regsvr32.exe 28 PID 2176 wrote to memory of 2348 2176 regsvr32.exe 28 PID 2176 wrote to memory of 2348 2176 regsvr32.exe 28 PID 2176 wrote to memory of 2348 2176 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\dc57ac7a27d6c22a8808169c53934254.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\dc57ac7a27d6c22a8808169c53934254.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2348
-