f686f33c05d63eb019164da669495fbb53c181d4d39603d03018afd883a923e9

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dll/Regdll.exe
Size

87KB
MD5

3a53fc15523b6cbdfeb6a7ddc13c01d8
SHA1

76238e63deb200955a8e68e4e2948e5be3a6675d
SHA256

da360aa2fb9a977a4504e0a240dbf56ab877f1da17d343d0c27d398a5600b0f0
SHA512

d6f83ce75e81c725157d9867f3ab06fcca9523923b49d72464a7048c2ead8ff1e8c19ad196cb4f07feae7625b693606dcc207db2e3ac38255a96ed07318dd130
SSDEEP

1536:uiUqXwQFxHosT0A2kDlq2KoNz22QiIPTw7QEKQvdcNO9YO79:uIwkxRskZqzoA2QiIPTw7QEK6dyOma9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\MenuExt\Web&2Pic Pro	Regdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\MenuExt\Web&2Pic Pro\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Dll\\web2pic_url.htm"	Regdll.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\MenuExt\Web&2Pic Pro\contexts = "243"	Regdll.exe

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\ProgID\ = "HtmlPictureManager.CatchPicUrl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\TypeLib\ = "{78BB0398-573C-4F8C-BD27-B57A41A17E19}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HtmlPictureManager.CatchPicUrl\Clsid\ = "{BB366341-1682-4F2D-833C-C281B6C924D8}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Dll\\web2pic_url.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}\1.0\ = "HtmlPictureManager Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\ = "CatchPicUrl Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Dll\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\TypeLib\ = "{78BB0398-573C-4F8C-BD27-B57A41A17E19}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HtmlPictureManager.CatchPicUrl	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HtmlPictureManager.CatchPicUrl\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\ = "ICatchPicUrl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HtmlPictureManager.CatchPicUrl\ = "CatchPicUrl Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Dll\\web2pic_url.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\ = "ICatchPicUrl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\TypeLib\ = "{78BB0398-573C-4F8C-BD27-B57A41A17E19}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2228	2012	Regdll.exe	31
PID 2012 wrote to memory of 2228	2012	Regdll.exe	31
PID 2012 wrote to memory of 2228	2012	Regdll.exe	31
PID 2012 wrote to memory of 2228	2012	Regdll.exe	31
PID 2012 wrote to memory of 2228	2012	Regdll.exe	31
PID 2012 wrote to memory of 2228	2012	Regdll.exe	31
PID 2012 wrote to memory of 2228	2012	Regdll.exe	31

C:\Users\Admin\AppData\Local\Temp\Dll\Regdll.exe
"C:\Users\Admin\AppData\Local\Temp\Dll\Regdll.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Dll\web2pic_url.dll"
  2⤵
  - Modifies registry class
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download