6c0e15103228cca40c53322f80fdf8385e9b57f4b62c80c1e9f6b7dce2fdc652

Analysis

max time kernel
139s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c0e15103228cca40c53322f80fdf8385e9b57f4b62c80c1e9f6b7dce2fdc652.dll
Size

541KB
MD5

61a316dd7374c18526a27683551b58fe
SHA1

7142aacf1dce49077b53e10ecf71aaaa03237bec
SHA256

6c0e15103228cca40c53322f80fdf8385e9b57f4b62c80c1e9f6b7dce2fdc652
SHA512

caf59052671bc31b51349fd83c4f01988fe5bd3537c583c7fea1fb65da1314f17acc83f91a9ab9f412a1341927f74c3d24e3b2f925a2fc1e2ebf609d73546aeb
SSDEEP

12288:SoLpxPjIUCjm778i05MvjUFlHN3Ef3hnnEqQo/Gmftvmlu9:SowUCmOujUFlHN3EpEho/Gmdmlu9

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1228	B76.tmp

Loads dropped DLL 2 IoCs

pid	Process
2304	regsvr32.exe
2304	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ir32_32.dll	B76.tmp
File created	C:\Windows\SysWOW64\mswstr10.dll	B76.tmp
File created	C:\Windows\SysWOW64\sqlunirl.dll	B76.tmp
File created	C:\Windows\SysWOW64\dmscript.dll	B76.tmp
File created	C:\Windows\SysWOW64\dplaysvr.exe	B76.tmp
File created	C:\Windows\SysWOW64\msexch40.dll	B76.tmp
File created	C:\Windows\SysWOW64\msjtes40.dll	B76.tmp
File created	C:\Windows\SysWOW64\mstext40.dll	B76.tmp
File created	C:\Windows\SysWOW64\InstallShield\_isdel.exe	B76.tmp
File created	C:\Windows\SysWOW64\d3d8.dll	B76.tmp
File created	C:\Windows\SysWOW64\dplayx.dll	B76.tmp
File opened for modification	C:\Windows\SysWOW64\mfc120.dll	B76.tmp
File created	C:\Windows\SysWOW64\msrd3x40.dll	B76.tmp
File opened for modification	C:\Windows\SysWOW64\msvcr120_clr0400.dll	B76.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igdumd32.dll	B76.tmp
File opened for modification	C:\Windows\SysWOW64\FM20.DLL	B76.tmp
File created	C:\Windows\SysWOW64\msjter40.dll	B76.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\amdpcom32.dll	B76.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdag.dll	B76.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igd10umd32.dll	B76.tmp
File created	C:\Windows\SysWOW64\d3dxof.dll	B76.tmp
File created	C:\Windows\SysWOW64\dpwsockx.dll	B76.tmp
File created	C:\Windows\SysWOW64\msexcl40.dll	B76.tmp
File created	C:\Windows\SysWOW64\rdvgumd32.dll	B76.tmp
File created	C:\Windows\SysWOW64\InstallShield\setup.exe	B76.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvd3dum.dll	B76.tmp
File created	C:\Windows\SysWOW64\iac25_32.ax	B76.tmp
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	B76.tmp
File opened for modification	C:\Windows\SysWOW64\MSCOMCTL.OCX	B76.tmp
File created	C:\Windows\SysWOW64\sqlwoa.dll	B76.tmp
File opened for modification	C:\Windows\SysWOW64\VBAME.DLL	B76.tmp
File opened for modification	C:\Windows\SysWOW64\atl100.dll	B76.tmp
File created	C:\Windows\SysWOW64\msorcl32.dll	B76.tmp
File created	C:\Windows\SysWOW64\migration\MediaPlayer-DLMigPlugin.dll	B76.tmp
File opened for modification	C:\Windows\SysWOW64\mfc100.dll	B76.tmp
File created	C:\Windows\SysWOW64\olecli32.dll	B76.tmp
File created	C:\Windows\SysWOW64\msrepl40.dll	B76.tmp
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	B76.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atidxx32.dll	B76.tmp
File created	C:\Windows\SysWOW64\FXSXP32.dll	B76.tmp
File created	C:\Windows\SysWOW64\ir41_32.ax	B76.tmp
File opened for modification	C:\Windows\SysWOW64\mfc100u.dll	B76.tmp
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	B76.tmp
File created	C:\Windows\SysWOW64\mfc40u.dll	B76.tmp
File opened for modification	C:\Windows\SysWOW64\msvcr120.dll	B76.tmp
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	B76.tmp
File created	C:\Windows\SysWOW64\crtdll.dll	B76.tmp
File created	C:\Windows\SysWOW64\explorer.exe	B76.tmp
File created	C:\Windows\SysWOW64\mfc40.dll	B76.tmp
File created	C:\Windows\SysWOW64\msvbvm60.dll	B76.tmp
File opened for modification	C:\Windows\SysWOW64\atl110.dll	B76.tmp
File opened for modification	C:\Windows\SysWOW64\mfc120u.dll	B76.tmp
File created	C:\Windows\SysWOW64\msxbde40.dll	B76.tmp
File created	C:\Windows\SysWOW64\audiodev.dll	B76.tmp
File created	C:\Windows\SysWOW64\msjet40.dll	B76.tmp
File opened for modification	C:\Windows\SysWOW64\msvcr110.dll	B76.tmp
File created	C:\Windows\SysWOW64\odbcjt32.dll	B76.tmp
File created	C:\Windows\SysWOW64\regedit.exe	B76.tmp
File created	C:\Windows\SysWOW64\setupSNK.exe	B76.tmp
File created	C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdva.dll	B76.tmp
File created	C:\Windows\SysWOW64\d3dim.dll	B76.tmp
File created	C:\Windows\SysWOW64\d3dim700.dll	B76.tmp
File created	C:\Windows\SysWOW64\expsrv.dll	B76.tmp
File opened for modification	C:\Windows\SysWOW64\mfc110u.dll	B76.tmp

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\mset7.dll	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEMANAGED.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MLSHEXT.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\ColleagueImport.dll	B76.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\rt3d.dll	B76.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEXBE.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OIMG.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONFILTER.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7EN.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sqlceca35.dll	B76.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl	B76.tmp
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\oisctrl.dll	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OUTLMIME.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\XPAGE3C.DLL	B76.tmp
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll	B76.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api	B76.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEREP.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DELIMWIN.FAE	B76.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSO.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSODCW.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\RECALL.DLL	B76.tmp
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe	B76.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api	B76.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIBUtils.dll	B76.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.aup	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\AUTHZAX.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OWSSUPP.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MLCFG32.CPL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE	B76.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api	B76.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api	B76.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXPSRV.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\IETAG.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7EN.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\EScript.api	B76.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe	B76.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	B76.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSETUP.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\ANALYS32.XLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEES.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VC\msdia90.dll	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBCONV.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7FR.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SOA.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SSGEN.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\VVIEWDWG.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api	B76.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOCF.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OMSXP32.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MCPS.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Wordcnv.dll	B76.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp	B76.tmp
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCL.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOHEVI.DLL	B76.tmp
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLAPPT.FAE	B76.tmp
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api	B76.tmp

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\Backup\wow64_microsoft-windows-oleacc_31bf3856ad364e35_6.1.7600.16385_none_d0ce59c770758425_oleacc.dll_2f3fa5bf	B76.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-mmsys_31bf3856ad364e35_6.1.7601.17514_none_c6ea7a022a2b6909\mmsys.cpl	B76.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-tapicore_31bf3856ad364e35_6.1.7600.16385_none_4a83748394a862f9\tapiperf.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\logman.exe	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-eventviewer_31bf3856ad364e35_6.1.7600.16385_none_6dc176bafd6e281f\els.dll	B76.tmp
File created	C:\Windows\winsxs\x86_netfx-vb_compiler_b03f5f7f11d50a3a_6.1.7601.17514_none_144b6bd462e4a41b\vbc.exe	B76.tmp
File created	C:\Windows\winsxs\x86_wpf-presentationhostexe_31bf3856ad364e35_6.2.7601.17514_none_3a2a6a811d2b5065\PresentationHost.exe	B76.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-mfplay_31bf3856ad364e35_6.1.7601.17514_none_5f24d6869e761d83\MFPlay.dll	B76.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_c79aef32ab85d92b\cmdl32.exe	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-errorreportingui_31bf3856ad364e35_6.1.7600.16385_none_ce3b80c0636ae33d\werui.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601.17514_none_b7c78d327d35e10e\t2embed.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-mssign32-dll_31bf3856ad364e35_6.1.7600.16385_none_ca0a23a23bc12926\mssign32.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-wintrust-dll_31bf3856ad364e35_6.1.7601.17514_none_f1b5a3b0f852fe0e\wintrust.dll	B76.tmp
File created	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100_x86	B76.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-scripting_31bf3856ad364e35_6.1.7600.16385_none_aeb1ef0f4e6bba1d\cscript.exe	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-content-filter-office_31bf3856ad364e35_7.0.7600.16385_none_3258451e823925d2\offfilt.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-downlevelmanifests_31bf3856ad364e35_6.1.7601.17514_none_04801f69e1dbd8e6\adfsmig.dll	B76.tmp
File created	C:\Windows\winsxs\Backup\x86_microsoft-windows-usp_31bf3856ad364e35_6.1.7601.17514_none_af01e2f9b6be7939_usp10.dll_8785b649	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-certificaterequesttool_31bf3856ad364e35_6.1.7600.16385_none_67e6e9a778bbd9d5\certreq.exe	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\IMEPADSV.EXE	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-m..ponents-mdac-msdatl_31bf3856ad364e35_6.1.7600.16385_none_e5eb668f6cf3ca2d\msdatl3.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-m..ponents-mdac-msdart_31bf3856ad364e35_6.1.7600.16385_none_e5e8afbb6cf66487\msdart.dll	B76.tmp
File created	C:\Windows\winsxs\x86_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_6.1.7600.16385_none_d2fff1dae966863c\csc.exe	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_11.2.9600.16428_none_ae214da780801b0f\RegisterIEPKEYs.exe	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-pdm-configuration_31bf3856ad364e35_11.2.9600.16428_none_d6876629731ce419\PDMSetup.exe	B76.tmp
File created	C:\Windows\winsxs\x86_networking-mpssvc_31bf3856ad364e35_6.1.7601.17514_none_0c80f0c5176cbb85\FirewallControlPanel.dll	B76.tmp
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AdoNetDiag.dll	B76.tmp
File created	C:\Windows\winsxs\Backup\wow64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_c8df7823424473a1_netbtugc.exe_825f4f74	B76.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-uiribbon_31bf3856ad364e35_6.1.7601.17514_none_db578bdb5e3559c6\UIRibbon.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-com-oleui_31bf3856ad364e35_6.1.7600.16385_none_204a50230f150f07\oledlg.dll	B76.tmp
File created	C:\Windows\winsxs\Backup\wow64_microsoft-windows-msxml60_31bf3856ad364e35_6.1.7601.17514_none_f0e8ac03e1d6bb5b_msxml6.dll_ebe15265	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-ieshims_31bf3856ad364e35_11.2.9600.16428_none_cdc5a77ff6e9c343\IEShims.dll	B76.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-m..uxiliarydisplay-cpl_31bf3856ad364e35_6.1.7601.17514_none_6204cf41c0e8b726\AuxiliaryDisplayCpl.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-tpm-adminsnapin_31bf3856ad364e35_6.1.7600.16385_none_77536d124094b997\TpmInit.exe	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-deltapackageexpander_31bf3856ad364e35_6.1.7601.17514_none_6be6001a9349f456\dpx.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_0b66cb34258c936f\smiengine.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-wmadmod_31bf3856ad364e35_6.1.7601.17514_none_885655287c3a2a8e\WMADMOD.DLL	B76.tmp
File created	C:\Windows\winsxs\x86_netfx-installutillib_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_8b3db65294ce6352\InstallUtilLib.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7601.17514_none_44b0c76c35d4b76d\wabfind.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d08d7da0442a985d\msvcr80.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.7601.17514_none_83801b5eed6392d9\GdiPlus.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-c..complus-runtime-qfe_31bf3856ad364e35_6.1.7600.16385_none_6b3984a4d9e2684a\catsrv.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_ef38a8d0d05cc2c7\IMJPDADM.EXE	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-n..protection-statusui_31bf3856ad364e35_6.1.7600.16385_none_3d715a438950ce7b\NAPSTAT.EXE	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\helpcins.dll	B76.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-downlevelmanifests_31bf3856ad364e35_6.1.7601.17514_none_04801f69e1dbd8e6\NlbMigPlugin.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-wmvsdecd_31bf3856ad364e35_6.1.7601.17514_none_6880e489030d43b0\WMVSDECD.DLL	B76.tmp
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtilLib.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-jsprofilerui_31bf3856ad364e35_11.2.9600.16428_none_793771322ae3b7fd\jsprofilerui.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-msident_31bf3856ad364e35_6.1.7600.16385_none_17fb8f9dae097073\msident.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-speechengine_31bf3856ad364e35_6.1.7600.16385_none_ee947359fb35d641\spsreng.dll	B76.tmp
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-downlevelmanifests_31bf3856ad364e35_6.1.7601.17514_none_04801f69e1dbd8e6\nlscoremig.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\wcp.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-deployment_31bf3856ad364e35_6.1.7601.17514_none_fdf660b64b901b2e\setupugc.exe	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-vgx_31bf3856ad364e35_8.0.7600.16385_none_07c7aec5c1108570\VGX.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-management-console_31bf3856ad364e35_6.1.7600.16385_none_0f49a133d6f5d42b\mmcshext.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-photoacquire_31bf3856ad364e35_6.1.7601.17514_none_363dce826b046f1f\PhotoAcq.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-security-pku2u_31bf3856ad364e35_6.1.7600.16385_none_7e462a69ffcb5639\pku2u.dll	B76.tmp
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe	B76.tmp
File created	C:\Windows\winsxs\wow64_microsoft-windows-tapi3_31bf3856ad364e35_6.1.7601.17514_none_c9c3618bda90b9f7\tapi3.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-directx-direct3d_31bf3856ad364e35_6.1.7600.16385_none_eb246466b6cc92e7\d3dim.dll	B76.tmp
File created	C:\Windows\winsxs\x86_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_6.1.7600.16385_none_fe75fb7856d846d5\DWWIN.EXE	B76.tmp

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{62776AC3-A015-4BA5-A1C7-DCD765881249}\ProxyStubClsid32\ = "{671B6145-4169-4ADD-9AF3-E6990EB2B325}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDE0D630-7801-47cd-984E-1F0AFBC5ACBF}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE79C475-D632-4A57-91B3-DA044FA27CDA}\2.0\ = "Adobe Reader File Preview Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3F77C747-A942-45B2-A812-097A1F5CFE6F}\ProxyStubClsid32\ = "{671B6145-4169-4ADD-9AF3-E6990EB2B325}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1E6C7A4-6B15-4C06-B1EF-88A4F2A886CB}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3F77C747-A942-45B2-A812-097A1F5CFE6F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{566A7BC7-B295-41B7-A818-12F9E5CA46CA}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C52A2CC-66F1-4B2B-A9E4-9723791F0BBD}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Adobe.Reader.HTMLPreview.1\CLSID\ = "{BDE0D630-7801-47cd-984E-1F0AFBC5ACBF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6c0e15103228cca40c53322f80fdf8385e9b57f4b62c80c1e9f6b7dce2fdc652.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{671B6145-4169-4ADD-9AF3-E6990EB2B325}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C52A2CC-66F1-4B2B-A9E4-9723791F0BBD}\ = "IAdobeInitializeWithStream"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{671B6145-4169-4ADD-9AF3-E6990EB2B325}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1E6C7A4-6B15-4C06-B1EF-88A4F2A886CB}\ = "IBitmapFactory"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{566A7BC7-B295-41B7-A818-12F9E5CA46CA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{566A7BC7-B295-41B7-A818-12F9E5CA46CA}\ProxyStubClsid32\ = "{671B6145-4169-4ADD-9AF3-E6990EB2B325}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1E6C7A4-6B15-4C06-B1EF-88A4F2A886CB}\NumMethods\ = "5"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{62776AC3-A015-4BA5-A1C7-DCD765881249}\ = "IAdobeInitializeWithFile"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDE0D630-7801-47cd-984E-1F0AFBC5ACBF}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3F77C747-A942-45B2-A812-097A1F5CFE6F}\ = "IBitmapProvider"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3F77C747-A942-45B2-A812-097A1F5CFE6F}\NumMethods\ = "7"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1E6C7A4-6B15-4C06-B1EF-88A4F2A886CB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\DLLSurrogate	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{671B6145-4169-4ADD-9AF3-E6990EB2B325}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6c0e15103228cca40c53322f80fdf8385e9b57f4b62c80c1e9f6b7dce2fdc652.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C52A2CC-66F1-4B2B-A9E4-9723791F0BBD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Adobe.Reader.HTMLPreview.1\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDE0D630-7801-47cd-984E-1F0AFBC5ACBF}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\ProgID\ = "Adobe.Reader.BitmapFactory.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{671B6145-4169-4ADD-9AF3-E6990EB2B325}\ = "PSFactoryBuffer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDE0D630-7801-47cd-984E-1F0AFBC5ACBF}\AppID = "{BDE0D630-7801-47cd-984E-1F0AFBC5ACBF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDE0D630-7801-47cd-984E-1F0AFBC5ACBF}\ProgID\ = "Adobe.Reader.HTMLPreview.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\ = "Adobe Reader Bitmap Factory Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BDE0D630-7801-47cd-984E-1F0AFBC5ACBF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{62776AC3-A015-4BA5-A1C7-DCD765881249}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Adobe.Reader.HTMLPreview.1\ = "Adobe Reader HTML Preview Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDE0D630-7801-47cd-984E-1F0AFBC5ACBF}\VersionIndependentProgID\ = "Adobe.Reader.HTMLPreview"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\TypeLib\ = "{BE79C475-D632-4A57-91B3-DA044FA27CDA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3F77C747-A942-45B2-A812-097A1F5CFE6F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{671B6145-4169-4ADD-9AF3-E6990EB2B325}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C52A2CC-66F1-4B2B-A9E4-9723791F0BBD}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE79C475-D632-4A57-91B3-DA044FA27CDA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{671B6145-4169-4ADD-9AF3-E6990EB2B325}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{671B6145-4169-4ADD-9AF3-E6990EB2B325}\ProxyStubClsid32\ = "{671B6145-4169-4ADD-9AF3-E6990EB2B325}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Adobe.Reader.HTMLPreview.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDE0D630-7801-47cd-984E-1F0AFBC5ACBF}\ = "Adobe Reader HTML Preview Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDE0D630-7801-47cd-984E-1F0AFBC5ACBF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1E6C7A4-6B15-4C06-B1EF-88A4F2A886CB}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{566A7BC7-B295-41B7-A818-12F9E5CA46CA}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F1E6C7A4-6B15-4C06-B1EF-88A4F2A886CB}\ProxyStubClsid32\ = "{671B6145-4169-4ADD-9AF3-E6990EB2B325}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{62776AC3-A015-4BA5-A1C7-DCD765881249}\NumMethods\ = "4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{566A7BC7-B295-41B7-A818-12F9E5CA46CA}\NumMethods\ = "11"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE79C475-D632-4A57-91B3-DA044FA27CDA}\2.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{671B6145-4169-4ADD-9AF3-E6990EB2B325}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{671B6145-4169-4ADD-9AF3-E6990EB2B325}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{671B6145-4169-4ADD-9AF3-E6990EB2B325}\ = "IBitmapConsumer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{62776AC3-A015-4BA5-A1C7-DCD765881249}\ProxyStubClsid32	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2304	1708	regsvr32.exe	28
PID 1708 wrote to memory of 2304	1708	regsvr32.exe	28
PID 1708 wrote to memory of 2304	1708	regsvr32.exe	28
PID 1708 wrote to memory of 2304	1708	regsvr32.exe	28
PID 1708 wrote to memory of 2304	1708	regsvr32.exe	28
PID 1708 wrote to memory of 2304	1708	regsvr32.exe	28
PID 1708 wrote to memory of 2304	1708	regsvr32.exe	28
PID 2304 wrote to memory of 1228	2304	regsvr32.exe	29
PID 2304 wrote to memory of 1228	2304	regsvr32.exe	29
PID 2304 wrote to memory of 1228	2304	regsvr32.exe	29
PID 2304 wrote to memory of 1228	2304	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6c0e15103228cca40c53322f80fdf8385e9b57f4b62c80c1e9f6b7dce2fdc652.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6c0e15103228cca40c53322f80fdf8385e9b57f4b62c80c1e9f6b7dce2fdc652.dll
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Users\Admin\AppData\Local\Temp\B76.tmp
    C:\Users\Admin\AppData\Local\Temp\B76.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B76.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
memory/2304-0-0x0000000000190000-0x00000000001D1000-memory.dmp

Filesize
260KB

Download