61412215fb26d53852080768f435afcfa050319f0431cc1c4f0ac6e203eeb5e2

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$_2_/BDIEHelper.dll
Size 323KB
Sample240605-cf2ylabg45
SHA256 6b894c1f5de423d08f5f28bcb52c95589c1a474c75f90563606f440d9a668125
MD5 962928acbfb8223c419615ceb8baca5f
SHA1 574e3815ea8683c75a360a6b527d6e27eda68247
SHA512 d656838985cd0641e3e9f268059b5c2f30ef98411867eb28bceb268c0085d559d65a611d0429265e513d4b1e08dc77bcfed6cbb13c5be946dbebd8d05d428980
SSDEEP 3072:H6RB60OcWgk4tUEB5zLi87ief/uM8a7zYWKaqCZrg/vutegfJogtzmIbCCtd:g+cxtCEBtd/pgW7VSuaemoVd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9AF85209-24E7-4031-80FA-D32BA8BAE55E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41AA1C76-EC23-4D0F-80A1-7E0DA3A4D46A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BDIEHelper.JSOnClick.1\ = "BDDownload IE JSOnClick Helper"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BDIEHelper.JSOnClick.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BDIEHelper.JSOnClick\CurVer\ = "BDIEHelper.JSOnClick.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54232AAA-3CB4-4035-8595-90E386E43E02}\ = "IBDDLIEPlugin"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BDIEHelper.JSOnClick.1\CLSID\ = "{9AF85209-24E7-4031-80FA-D32BA8BAE55E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BDIEHelper.JSOnClick\ = "BDDownload IE JSOnClick Helper"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BDIEHelper.JSOnClick\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41AA1C76-EC23-4D0F-80A1-7E0DA3A4D46A}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54232AAA-3CB4-4035-8595-90E386E43E02}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54232AAA-3CB4-4035-8595-90E386E43E02}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54232AAA-3CB4-4035-8595-90E386E43E02}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BDIEHelper.JSOnClick.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9AF85209-24E7-4031-80FA-D32BA8BAE55E}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9AF85209-24E7-4031-80FA-D32BA8BAE55E}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9AF85209-24E7-4031-80FA-D32BA8BAE55E}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9AF85209-24E7-4031-80FA-D32BA8BAE55E}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54232AAA-3CB4-4035-8595-90E386E43E02}\TypeLib\ = "{41AA1C76-EC23-4D0F-80A1-7E0DA3A4D46A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9AF85209-24E7-4031-80FA-D32BA8BAE55E}\ = "BDDownload IE JSOnClick Helper"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9AF85209-24E7-4031-80FA-D32BA8BAE55E}\ProgID\ = "BDIEHelper.JSOnClick.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9AF85209-24E7-4031-80FA-D32BA8BAE55E}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9AF85209-24E7-4031-80FA-D32BA8BAE55E}\TypeLib\ = "{41AA1C76-EC23-4d0f-80A1-7E0DA3A4D46A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41AA1C76-EC23-4D0F-80A1-7E0DA3A4D46A}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BDIEHelper.JSOnClick	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BDIEHelper.JSOnClick\CLSID\ = "{9AF85209-24E7-4031-80FA-D32BA8BAE55E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BDIEHelper.JSOnClick\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54232AAA-3CB4-4035-8595-90E386E43E02}\ = "IBDDLIEPlugin"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54232AAA-3CB4-4035-8595-90E386E43E02}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41AA1C76-EC23-4D0F-80A1-7E0DA3A4D46A}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$_2_\\BDIEHelper.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41AA1C76-EC23-4D0F-80A1-7E0DA3A4D46A}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41AA1C76-EC23-4D0F-80A1-7E0DA3A4D46A}\1.0\HELPDIR\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41AA1C76-EC23-4D0F-80A1-7E0DA3A4D46A}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54232AAA-3CB4-4035-8595-90E386E43E02}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54232AAA-3CB4-4035-8595-90E386E43E02}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54232AAA-3CB4-4035-8595-90E386E43E02}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9AF85209-24E7-4031-80FA-D32BA8BAE55E}\VersionIndependentProgID\ = "BDIEHelper.JSOnClick"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9AF85209-24E7-4031-80FA-D32BA8BAE55E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$_2_\\BDIEHelper.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9AF85209-24E7-4031-80FA-D32BA8BAE55E}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54232AAA-3CB4-4035-8595-90E386E43E02}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41AA1C76-EC23-4D0F-80A1-7E0DA3A4D46A}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54232AAA-3CB4-4035-8595-90E386E43E02}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54232AAA-3CB4-4035-8595-90E386E43E02}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41AA1C76-EC23-4D0F-80A1-7E0DA3A4D46A}\1.0\ = "BDIEHelper 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41AA1C76-EC23-4D0F-80A1-7E0DA3A4D46A}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54232AAA-3CB4-4035-8595-90E386E43E02}\TypeLib\ = "{41AA1C76-EC23-4D0F-80A1-7E0DA3A4D46A}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 3432	4888	regsvr32.exe	83
PID 4888 wrote to memory of 3432	4888	regsvr32.exe	83
PID 4888 wrote to memory of 3432	4888	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$_2_\BDIEHelper.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$_2_\BDIEHelper.dll
  2⤵
  - Modifies registry class
  PID:3432

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads