27bf8e239f59a87c27cc9d1c7e92adece25427d246cb5c04fa0237930181fea9 | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 04:47

Sharing

Report Analysis Logs

General

Target

$R2/WOL/WOLBrowser.dll
Size

72KB
MD5

9952f3320d89059c9440369ca038dd9c
SHA1

1ab6a9bcfe26aa9a28c0a8d269a45ce2158bec24
SHA256

c92d0f1f7a45cebe0ef4cac6abeb3de0bc3cab48da427ba31be5490752813291
SHA512

d80fcb0c1a4b31a9b1d83cccc2ae32960c1352baddf8e9ead93620ed5f6b074d5c9af477263bda55c62497b30d2aae71c5eebf2f0c995de032ae4bba13e21693
SSDEEP

1536:ZjmiQi+tv7TvKrn0zerKRrOwE5KJEhLoawgx:ZjmiQi+t6cKsrOw0OEhLoaRx

Score

1^/10

Malware Config

Signatures

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Westwood.WOLBrowser\CurVer\ = "Westwood.WOLBrowser.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Westwood.WOLBrowser.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6F33E57-C630-4EAF-AA4A-43F3A59EA608}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6F33E57-C630-4EAF-AA4A-43F3A59EA608}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6F33E57-C630-4EAF-AA4A-43F3A59EA608}\VersionIndependentProgID\ = "Westwood.WOLBrowser"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Westwood.WOLBrowser\ = "Westwood Embedded Browser"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Westwood.WOLBrowser\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6F33E57-C630-4EAF-AA4A-43F3A59EA608}\ = "Westwood Embedded Browser"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6F33E57-C630-4EAF-AA4A-43F3A59EA608}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Westwood.WOLBrowser	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Westwood.WOLBrowser\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6F33E57-C630-4EAF-AA4A-43F3A59EA608}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R2\\WOL\\WOLBrowser.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6F33E57-C630-4EAF-AA4A-43F3A59EA608}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6F33E57-C630-4EAF-AA4A-43F3A59EA608}\ProgID\ = "Westwood.WOLBrowser.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Westwood.WOLBrowser.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Westwood.WOLBrowser.1\CLSID\ = "{E6F33E57-C630-4EAF-AA4A-43F3A59EA608}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Westwood.WOLBrowser\CLSID\ = "{E6F33E57-C630-4EAF-AA4A-43F3A59EA608}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Westwood.WOLBrowser.1\ = "Westwood Embedded Browser"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2492	2068	regsvr32.exe	28
PID 2068 wrote to memory of 2492	2068	regsvr32.exe	28
PID 2068 wrote to memory of 2492	2068	regsvr32.exe	28
PID 2068 wrote to memory of 2492	2068	regsvr32.exe	28
PID 2068 wrote to memory of 2492	2068	regsvr32.exe	28
PID 2068 wrote to memory of 2492	2068	regsvr32.exe	28
PID 2068 wrote to memory of 2492	2068	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$R2\WOL\WOLBrowser.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$R2\WOL\WOLBrowser.dll
  2⤵
  - Modifies registry class
  PID:2492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads