Overview
overview
7Static
static
3HashTab_v6...up.exe
windows7-x64
7HashTab_v6...up.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$R0.dll
windows7-x64
7$R0.dll
windows10-2004-x64
7HashTab32-...34.dll
windows7-x64
1HashTab32-...34.dll
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 08:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
HashTab_v6.0.0.34_Setup.exe
Resource
win7-20240220-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
HashTab_v6.0.0.34_Setup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$R0.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$R0.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
HashTab32-6.0.0.34.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
HashTab32-6.0.0.34.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
$R0.dll
-
Size
1.3MB
-
MD5
6e6559ac4c7abf6f7d60165e1c2f9b65
-
SHA1
2d0faf4d27680c9c971f8ffbf2b0152b8fb9c4c2
-
SHA256
33110cfbb450b0a06a9a70449e674774823e730ed37dda83a25dd0dbc81f8b21
-
SHA512
22eff4290feae094d14559cf150bc3d6cc5203f79554d8bee8bad7a7b509a5cdd953e45eb897dabffa1377b7636e03cdd83ec6de903970b65dce1f7475af4dca
-
SSDEEP
24576:hqSCTJeq4W2L/yF6/D48i8Kfy5w0aEJiBjkL9hhKfVqe:vCgGF68kK6mtTBChwVj
Score
7/10
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CA10CE2A-5097-4D39-96A8-1E64ADFA9096}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.DropTargetImpl.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B3D7DD5D-510B-477C-9521-2BCBCC91762C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1BC2DEA9-DCDB-4961-8BDB-107767D135A9}\TypeLib\ = "{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5FCF1002-1131-4C88-B982-1B5055C7C945} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\ProgID\ = "HashTab.HashPage.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\ = "Hasher Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CA10CE2A-5097-4D39-96A8-1E64ADFA9096}\ = "IReportProgress" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.DropTargetImpl\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\ProgID\ = "HashTab.DropTargetImpl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.HashPage.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592}\ = "IHashMenu" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592}\TypeLib\ = "{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1BC2DEA9-DCDB-4961-8BDB-107767D135A9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.HashPage\ = "HashPage Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B3D7DD5D-510B-477C-9521-2BCBCC91762C}\ = "IHashPage" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5FCF1002-1131-4C88-B982-1B5055C7C945}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.DropTargetImpl.1\CLSID\ = "{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.DropTargetImpl\CLSID\ = "{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1BC2DEA9-DCDB-4961-8BDB-107767D135A9}\ = "IDropTargetImpl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1BC2DEA9-DCDB-4961-8BDB-107767D135A9}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5FCF1002-1131-4C88-B982-1B5055C7C945}\ = "IHasher" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5FCF1002-1131-4C88-B982-1B5055C7C945}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.DropTargetImpl regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.DropTargetImpl\ = "DropTargetImpl Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CA10CE2A-5097-4D39-96A8-1E64ADFA9096} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5FCF1002-1131-4C88-B982-1B5055C7C945}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CA10CE2A-5097-4D39-96A8-1E64ADFA9096}\ = "IReportProgress" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CA10CE2A-5097-4D39-96A8-1E64ADFA9096}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CA10CE2A-5097-4D39-96A8-1E64ADFA9096}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\AppID = "{0A3C1C8E-5829-4CFD-B1CC-475DB010B883}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\ = "ReportProgress Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5FCF1002-1131-4C88-B982-1B5055C7C945}\TypeLib\ = "{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3D7DD5D-510B-477C-9521-2BCBCC91762C}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1BC2DEA9-DCDB-4961-8BDB-107767D135A9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.DropTargetImpl\CurVer\ = "HashTab.DropTargetImpl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\ = "DropTargetImpl Class" regsvr32.exe