ac6d3f36922917f8ac7873fbc4a0a06334daf12c04bd6e4809ff56d7c2283a84

Analysis

max time kernel
17s
max time network
19s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

联通宽带拨号客户端/WINHTTP5.dll
Size

284KB
MD5

1d030bf7c36f7998d3783af54eb0cf92
SHA1

b27c12c5cd60f25c33049a7a46db10e6640165e6
SHA256

a648e8e8b73a750007e73db5a6a0e39852498fcfb4ca587dbe16d19630ee54de
SHA512

bdd370b1a4b6db07fabbb688115d7d7c882662b892b8f88fad2600eead642ac899f3d9a9f637355b889e5d1dbe7409ccdc6ace5fd3d62e37fbec59e872b500da
SSDEEP

6144:HHMjSWGK4dwIHLsjwUlIf9myzLnUW2Npzwtkp5LHb3X8fcA9eLYleY5THa:aSJzH7fRc5/n8kA9e8LE

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	regsvr32.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinHttp.WinHttpRequest.5\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}\ProgID\ = "WinHttp.WinHttpRequest.5"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}\TypeLib\ = "{c92a03cf-b92b-404f-9ac5-58664a592e4c}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinHttp.WinHttpRequest.5\CLSID\ = "{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}\InProcServer32\ = "%SystemDrive%\\Users\\Admin\\AppData\\Local\\Temp\\?????????\\WINHTTP5.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinHttp.WinHttpRequest.5	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}\ = "WinHttpRequest Component"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinHttp.WinHttpRequest.5\ = "WinHttpRequest Component"	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	1976	regsvr32.exe
Token: SeRestorePrivilege	1976	regsvr32.exe
Token: SeRestorePrivilege	1976	regsvr32.exe
Token: SeRestorePrivilege	1976	regsvr32.exe
Token: SeRestorePrivilege	1976	regsvr32.exe
Token: SeRestorePrivilege	1976	regsvr32.exe
Token: SeRestorePrivilege	1976	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1976	2244	regsvr32.exe	29
PID 2244 wrote to memory of 1976	2244	regsvr32.exe	29
PID 2244 wrote to memory of 1976	2244	regsvr32.exe	29
PID 2244 wrote to memory of 1976	2244	regsvr32.exe	29
PID 2244 wrote to memory of 1976	2244	regsvr32.exe	29
PID 2244 wrote to memory of 1976	2244	regsvr32.exe	29
PID 2244 wrote to memory of 1976	2244	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\联通宽带拨号客户端\WINHTTP5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\联通宽带拨号客户端\WINHTTP5.dll
  2⤵
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:1976

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads