Analysis
- max time kernel
118s - max time network
119s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
21/06/2024, 12:43
Behavioral task
behavioral1
Sample
e5af3b8208bb4097cb986c3ee1d6152698a52ebf124f25de964927d24516669c.dll
Resource
win7-20240611-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
e5af3b8208bb4097cb986c3ee1d6152698a52ebf124f25de964927d24516669c.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target e5af3b8208bb4097cb986c3ee1d6152698a52ebf124f25de964927d24516669c.dll
- Size 176KB
- Sample240621-px2elstfpn
- SHA256 e5af3b8208bb4097cb986c3ee1d6152698a52ebf124f25de964927d24516669c
- MD5 d8fb66eba757ede71e1217beed9c1781
- SHA1 2427804b70e478c663a55e5aa4d9541e20120b50
- SHA512 9d51e3a4243fae6c354e8b81a4acbb9f2966ea8f6c7419dd79b486391af3d5873768889f9e6850d6f0b4ca844b5ceefee508d2366d6bfd2d0390286043163227
- SSDEEP 3072:G4c+aFQGAOGWcroDwXrJsCkK3hYIQtHu1tW:GV+aFWOGWioDspzLmu1
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E4-B259-11CF-BFC7-444553540000}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E5-B259-11CF-BFC7-444553540000} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E5-B259-11CF-BFC7-444553540000}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E4-B259-11CF-BFC7-444553540000} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID regsvr32.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2228 regsvr32.exe 2228 regsvr32.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 2228 regsvr32.exe Token: SeCreateTokenPrivilege 2228 regsvr32.exe Token: SeAssignPrimaryTokenPrivilege 2228 regsvr32.exe Token: SeLockMemoryPrivilege 2228 regsvr32.exe Token: SeIncreaseQuotaPrivilege 2228 regsvr32.exe Token: SeMachineAccountPrivilege 2228 regsvr32.exe Token: SeTcbPrivilege 2228 regsvr32.exe Token: SeSecurityPrivilege 2228 regsvr32.exe Token: SeTakeOwnershipPrivilege 2228 regsvr32.exe Token: SeLoadDriverPrivilege 2228 regsvr32.exe Token: SeSystemProfilePrivilege 2228 regsvr32.exe Token: SeSystemtimePrivilege 2228 regsvr32.exe Token: SeProfSingleProcessPrivilege 2228 regsvr32.exe Token: SeIncBasePriorityPrivilege 2228 regsvr32.exe Token: SeCreatePagefilePrivilege 2228 regsvr32.exe Token: SeCreatePermanentPrivilege 2228 regsvr32.exe Token: SeBackupPrivilege 2228 regsvr32.exe Token: SeRestorePrivilege 2228 regsvr32.exe Token: SeShutdownPrivilege 2228 regsvr32.exe Token: SeDebugPrivilege 2228 regsvr32.exe Token: SeAuditPrivilege 2228 regsvr32.exe Token: SeSystemEnvironmentPrivilege 2228 regsvr32.exe Token: SeChangeNotifyPrivilege 2228 regsvr32.exe Token: SeRemoteShutdownPrivilege 2228 regsvr32.exe Token: SeUndockPrivilege 2228 regsvr32.exe Token: SeSyncAgentPrivilege 2228 regsvr32.exe Token: SeEnableDelegationPrivilege 2228 regsvr32.exe Token: SeManageVolumePrivilege 2228 regsvr32.exe Token: SeImpersonatePrivilege 2228 regsvr32.exe Token: SeCreateGlobalPrivilege 2228 regsvr32.exe Token: 31 2228 regsvr32.exe Token: 32 2228 regsvr32.exe Token: 33 2228 regsvr32.exe Token: 34 2228 regsvr32.exe Token: 35 2228 regsvr32.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2228 regsvr32.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2228 2372 regsvr32.exe 28 PID 2372 wrote to memory of 2228 2372 regsvr32.exe 28 PID 2372 wrote to memory of 2228 2372 regsvr32.exe 28 PID 2372 wrote to memory of 2228 2372 regsvr32.exe 28 PID 2372 wrote to memory of 2228 2372 regsvr32.exe 28 PID 2372 wrote to memory of 2228 2372 regsvr32.exe 28 PID 2372 wrote to memory of 2228 2372 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e5af3b8208bb4097cb986c3ee1d6152698a52ebf124f25de964927d24516669c.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e5af3b8208bb4097cb986c3ee1d6152698a52ebf124f25de964927d24516669c.dll2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2228
-