Overview
overview
7Static
static
3tor-browse...15.exe
windows11-21h2-x64
7$PLUGINSDI...LL.dll
windows11-21h2-x64
1$PLUGINSDI...em.dll
windows11-21h2-x64
1$PLUGINSDI...gs.dll
windows11-21h2-x64
1Browser/Ac...al.dll
windows11-21h2-x64
7Browser/To...nt.exe
windows11-21h2-x64
1Browser/To...rd.exe
windows11-21h2-x64
1Browser/To...nt.exe
windows11-21h2-x64
1Browser/To...nt.exe
windows11-21h2-x64
1Browser/To...or.exe
windows11-21h2-x64
3chrome/bro...w.html
windows11-21h2-x64
1chrome/bro...dow.js
windows11-21h2-x64
3Browser/d3...47.dll
windows11-21h2-x64
1Browser/de...efs.js
windows11-21h2-x64
3Browser/firefox.exe
windows11-21h2-x64
7Browser/fo...ar.ps1
windows11-21h2-x64
3Browser/freebl3.dll
windows11-21h2-x64
1Browser/ip...ts.dll
windows11-21h2-x64
1Browser/lgpllibs.dll
windows11-21h2-x64
1Browser/libEGL.dll
windows11-21h2-x64
1Browser/libGLESv2.dll
windows11-21h2-x64
1Browser/mo...ec.dll
windows11-21h2-x64
1Browser/mozavutil.dll
windows11-21h2-x64
1Browser/mozglue.dll
windows11-21h2-x64
1Browser/nss3.dll
windows11-21h2-x64
1Browser/nssckbi.dll
windows11-21h2-x64
1Browser/os...ts.dll
windows11-21h2-x64
1Browser/pl...er.exe
windows11-21h2-x64
1Browser/qipcap64.dll
windows11-21h2-x64
1Browser/softokn3.dll
windows11-21h2-x64
1Browser/updater.exe
windows11-21h2-x64
1Browser/xul.dll
windows11-21h2-x64
1Analysis
-
max time kernel
84s -
max time network
97s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
25/05/2024, 22:03
Static task
static1
Behavioral task
behavioral1
Sample
tor-browser-windows-x86_64-portable-13.0.15.exe
Resource
win11-20240426-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240426-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
Browser/AccessibleMarshal.dll
Resource
win11-20240508-en
Behavioral task
behavioral6
Sample
Browser/TorBrowser/Tor/PluggableTransports/conjure-client.exe
Resource
win11-20240426-en
Behavioral task
behavioral7
Sample
Browser/TorBrowser/Tor/PluggableTransports/lyrebird.exe
Resource
win11-20240508-en
Behavioral task
behavioral8
Sample
Browser/TorBrowser/Tor/PluggableTransports/snowflake-client.exe
Resource
win11-20240426-en
Behavioral task
behavioral9
Sample
Browser/TorBrowser/Tor/PluggableTransports/webtunnel-client.exe
Resource
win11-20240426-en
Behavioral task
behavioral10
Sample
Browser/TorBrowser/Tor/tor.exe
Resource
win11-20240426-en
Behavioral task
behavioral11
Sample
chrome/browser/content/browser/migration/migration-dialog-window.html
Resource
win11-20240508-en
Behavioral task
behavioral12
Sample
chrome/browser/content/browser/migration/migration-dialog-window.js
Resource
win11-20240508-en
Behavioral task
behavioral13
Sample
Browser/d3dcompiler_47.dll
Resource
win11-20240508-en
Behavioral task
behavioral14
Sample
Browser/defaults/pref/channel-prefs.js
Resource
win11-20240426-en
Behavioral task
behavioral15
Sample
Browser/firefox.exe
Resource
win11-20240508-en
Behavioral task
behavioral16
Sample
Browser/fonts/NotoSansNKo-Regular.ps1
Resource
win11-20240508-en
Behavioral task
behavioral17
Sample
Browser/freebl3.dll
Resource
win11-20240426-en
Behavioral task
behavioral18
Sample
Browser/ipcclientcerts.dll
Resource
win11-20240426-en
Behavioral task
behavioral19
Sample
Browser/lgpllibs.dll
Resource
win11-20240426-en
Behavioral task
behavioral20
Sample
Browser/libEGL.dll
Resource
win11-20240419-en
Behavioral task
behavioral21
Sample
Browser/libGLESv2.dll
Resource
win11-20240426-en
Behavioral task
behavioral22
Sample
Browser/mozavcodec.dll
Resource
win11-20240419-en
Behavioral task
behavioral23
Sample
Browser/mozavutil.dll
Resource
win11-20240508-en
Behavioral task
behavioral24
Sample
Browser/mozglue.dll
Resource
win11-20240426-en
Behavioral task
behavioral25
Sample
Browser/nss3.dll
Resource
win11-20240508-en
Behavioral task
behavioral26
Sample
Browser/nssckbi.dll
Resource
win11-20240426-en
Behavioral task
behavioral27
Sample
Browser/osclientcerts.dll
Resource
win11-20240508-en
Behavioral task
behavioral28
Sample
Browser/plugin-container.exe
Resource
win11-20240426-en
Behavioral task
behavioral29
Sample
Browser/qipcap64.dll
Resource
win11-20240426-en
Behavioral task
behavioral30
Sample
Browser/softokn3.dll
Resource
win11-20240426-en
Behavioral task
behavioral31
Sample
Browser/updater.exe
Resource
win11-20240508-en
Behavioral task
behavioral32
Sample
Browser/xul.dll
Resource
win11-20240508-en
General
-
Target
Browser/AccessibleMarshal.dll
-
Size
25KB
-
MD5
a884238ae4805cd28b8cfee56500c875
-
SHA1
db82c33a6e4c32c4fd57056bb2bb40e5b7d5dfb5
-
SHA256
80ec396632fd124e78bd35764af7ad4587a0d8090c21598d7abd0d133890763d
-
SHA512
2ce20312b4ede002596a9c2ec01da90434f1a70ab9b0751bc89652398f0fb2772fdf1b56c4c5de4390154f78178cce6444e9f1340bbf81a539045af3865b32f0
-
SSDEEP
384:RrUrKdJpDPepeEOGfc54yEI9Mk8JjUycDieEY:yEpSpeEOGfKERJjgDt
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Browser\\AccessibleMarshal.dll" regsvr32.exe -
Modifies registry class 25 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\NumMethods\ = "18" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ = "ISimpleDOMText" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\NumMethods\ = "8" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Interface regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ = "ISimpleDOMDocument" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ProxyStubClsid32\ = "{1814CEEB-49E2-407F-AF99-FA755A7D2607}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Browser\\AccessibleMarshal.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D68D6D0-D93D-4D08-A30D-F00DD1F45B24}\NumMethods\ = "9" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ = "PSFactoryBuffer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E747BE5-2052-4265-8AF0-8ECAD7AAD1C0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\ = "ISimpleDOMNode" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\NumMethods regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1814CEEB-49E2-407F-AF99-FA755A7D2607}\InProcServer32 regsvr32.exe