Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-06-2024 04:34
Behavioral task
behavioral1
Sample
c4567e7e3eb80d54cf996c5d082907395e9106a17ede4cc43026b113893017a7.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c4567e7e3eb80d54cf996c5d082907395e9106a17ede4cc43026b113893017a7.dll
Resource
win10v2004-20240226-en
General
-
Target
c4567e7e3eb80d54cf996c5d082907395e9106a17ede4cc43026b113893017a7.dll
-
Size
176KB
-
MD5
02beb8b4d46c253f2c32f990b1d518e6
-
SHA1
b4d587f6c5286c950c1b24b8bbb0d3c4aae0d82e
-
SHA256
c4567e7e3eb80d54cf996c5d082907395e9106a17ede4cc43026b113893017a7
-
SHA512
f764d4810af9f78bc959fce908d226e06ba2ebc4600d31af91a5dc8768ef2716ba1d2a06817a54667c4840542993b715147572b5915391756ed59836ed6a8b0b
-
SSDEEP
3072:D4c+aFQGAOGWcroDwXrJsCkK3hYIQtHu1tW:DV+aFWOGWioDspzLmu1
Malware Config
Signatures
-
Modifies registry class 6 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E5-B259-11CF-BFC7-444553540000}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E4-B259-11CF-BFC7-444553540000} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E4-B259-11CF-BFC7-444553540000}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E5-B259-11CF-BFC7-444553540000} regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 1252 regsvr32.exe 1252 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
regsvr32.exedescription pid process Token: 1 1252 regsvr32.exe Token: SeCreateTokenPrivilege 1252 regsvr32.exe Token: SeAssignPrimaryTokenPrivilege 1252 regsvr32.exe Token: SeLockMemoryPrivilege 1252 regsvr32.exe Token: SeIncreaseQuotaPrivilege 1252 regsvr32.exe Token: SeMachineAccountPrivilege 1252 regsvr32.exe Token: SeTcbPrivilege 1252 regsvr32.exe Token: SeSecurityPrivilege 1252 regsvr32.exe Token: SeTakeOwnershipPrivilege 1252 regsvr32.exe Token: SeLoadDriverPrivilege 1252 regsvr32.exe Token: SeSystemProfilePrivilege 1252 regsvr32.exe Token: SeSystemtimePrivilege 1252 regsvr32.exe Token: SeProfSingleProcessPrivilege 1252 regsvr32.exe Token: SeIncBasePriorityPrivilege 1252 regsvr32.exe Token: SeCreatePagefilePrivilege 1252 regsvr32.exe Token: SeCreatePermanentPrivilege 1252 regsvr32.exe Token: SeBackupPrivilege 1252 regsvr32.exe Token: SeRestorePrivilege 1252 regsvr32.exe Token: SeShutdownPrivilege 1252 regsvr32.exe Token: SeDebugPrivilege 1252 regsvr32.exe Token: SeAuditPrivilege 1252 regsvr32.exe Token: SeSystemEnvironmentPrivilege 1252 regsvr32.exe Token: SeChangeNotifyPrivilege 1252 regsvr32.exe Token: SeRemoteShutdownPrivilege 1252 regsvr32.exe Token: SeUndockPrivilege 1252 regsvr32.exe Token: SeSyncAgentPrivilege 1252 regsvr32.exe Token: SeEnableDelegationPrivilege 1252 regsvr32.exe Token: SeManageVolumePrivilege 1252 regsvr32.exe Token: SeImpersonatePrivilege 1252 regsvr32.exe Token: SeCreateGlobalPrivilege 1252 regsvr32.exe Token: 31 1252 regsvr32.exe Token: 32 1252 regsvr32.exe Token: 33 1252 regsvr32.exe Token: 34 1252 regsvr32.exe Token: 35 1252 regsvr32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
regsvr32.exepid process 1252 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 2068 wrote to memory of 1252 2068 regsvr32.exe regsvr32.exe PID 2068 wrote to memory of 1252 2068 regsvr32.exe regsvr32.exe PID 2068 wrote to memory of 1252 2068 regsvr32.exe regsvr32.exe PID 2068 wrote to memory of 1252 2068 regsvr32.exe regsvr32.exe PID 2068 wrote to memory of 1252 2068 regsvr32.exe regsvr32.exe PID 2068 wrote to memory of 1252 2068 regsvr32.exe regsvr32.exe PID 2068 wrote to memory of 1252 2068 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c4567e7e3eb80d54cf996c5d082907395e9106a17ede4cc43026b113893017a7.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\c4567e7e3eb80d54cf996c5d082907395e9106a17ede4cc43026b113893017a7.dll2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1252
-