Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 16:22
Behavioral task
behavioral1
Sample
8f4a63fff4946955c634287fac148a15597796508535a88d4242779dd1aa84c4.dll
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
8f4a63fff4946955c634287fac148a15597796508535a88d4242779dd1aa84c4.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
8f4a63fff4946955c634287fac148a15597796508535a88d4242779dd1aa84c4.dll
-
Size
176KB
-
MD5
8bff4b3760fd815e28dba1b03304fa38
-
SHA1
cb73f0dffb8ce4738922f7d8ace7f4a0c23c2eea
-
SHA256
8f4a63fff4946955c634287fac148a15597796508535a88d4242779dd1aa84c4
-
SHA512
8368e3f052a1d745a7bb6a4267f30972bde472de4e3579aa8ce0b4f1f57d086be70d637518ce89e369d530f573b066617c6662d548ad194f2efebf7dbddf25de
-
SSDEEP
3072:C4c+aFQGAOGWcroDwXrJsCkK3hYIQtHu1tW:CV+aFWOGWioDspzLmu1
Score
1/10
Malware Config
Signatures
-
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E4-B259-11CF-BFC7-444553540000} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E4-B259-11CF-BFC7-444553540000}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E5-B259-11CF-BFC7-444553540000} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E5-B259-11CF-BFC7-444553540000}\InProcServer32 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1636 regsvr32.exe 1636 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 1636 regsvr32.exe Token: SeCreateTokenPrivilege 1636 regsvr32.exe Token: SeAssignPrimaryTokenPrivilege 1636 regsvr32.exe Token: SeLockMemoryPrivilege 1636 regsvr32.exe Token: SeIncreaseQuotaPrivilege 1636 regsvr32.exe Token: SeMachineAccountPrivilege 1636 regsvr32.exe Token: SeTcbPrivilege 1636 regsvr32.exe Token: SeSecurityPrivilege 1636 regsvr32.exe Token: SeTakeOwnershipPrivilege 1636 regsvr32.exe Token: SeLoadDriverPrivilege 1636 regsvr32.exe Token: SeSystemProfilePrivilege 1636 regsvr32.exe Token: SeSystemtimePrivilege 1636 regsvr32.exe Token: SeProfSingleProcessPrivilege 1636 regsvr32.exe Token: SeIncBasePriorityPrivilege 1636 regsvr32.exe Token: SeCreatePagefilePrivilege 1636 regsvr32.exe Token: SeCreatePermanentPrivilege 1636 regsvr32.exe Token: SeBackupPrivilege 1636 regsvr32.exe Token: SeRestorePrivilege 1636 regsvr32.exe Token: SeShutdownPrivilege 1636 regsvr32.exe Token: SeDebugPrivilege 1636 regsvr32.exe Token: SeAuditPrivilege 1636 regsvr32.exe Token: SeSystemEnvironmentPrivilege 1636 regsvr32.exe Token: SeChangeNotifyPrivilege 1636 regsvr32.exe Token: SeRemoteShutdownPrivilege 1636 regsvr32.exe Token: SeUndockPrivilege 1636 regsvr32.exe Token: SeSyncAgentPrivilege 1636 regsvr32.exe Token: SeEnableDelegationPrivilege 1636 regsvr32.exe Token: SeManageVolumePrivilege 1636 regsvr32.exe Token: SeImpersonatePrivilege 1636 regsvr32.exe Token: SeCreateGlobalPrivilege 1636 regsvr32.exe Token: 31 1636 regsvr32.exe Token: 32 1636 regsvr32.exe Token: 33 1636 regsvr32.exe Token: 34 1636 regsvr32.exe Token: 35 1636 regsvr32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1636 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1968 wrote to memory of 1636 1968 regsvr32.exe 28 PID 1968 wrote to memory of 1636 1968 regsvr32.exe 28 PID 1968 wrote to memory of 1636 1968 regsvr32.exe 28 PID 1968 wrote to memory of 1636 1968 regsvr32.exe 28 PID 1968 wrote to memory of 1636 1968 regsvr32.exe 28 PID 1968 wrote to memory of 1636 1968 regsvr32.exe 28 PID 1968 wrote to memory of 1636 1968 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8f4a63fff4946955c634287fac148a15597796508535a88d4242779dd1aa84c4.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\8f4a63fff4946955c634287fac148a15597796508535a88d4242779dd1aa84c4.dll2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1636
-