Analysis
-
max time kernel
95s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2024, 05:50
Behavioral task
behavioral1
Sample
80d3dacf98c8a87ce4934c771458c4d2ad1733b5208477046894926dcbf64f3e.dll
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
80d3dacf98c8a87ce4934c771458c4d2ad1733b5208477046894926dcbf64f3e.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
80d3dacf98c8a87ce4934c771458c4d2ad1733b5208477046894926dcbf64f3e.dll
-
Size
176KB
-
MD5
19b2e10f6d8ab097710681af26f11597
-
SHA1
90a7cefd008fd056193ac63b2a12a54f1a12cea4
-
SHA256
80d3dacf98c8a87ce4934c771458c4d2ad1733b5208477046894926dcbf64f3e
-
SHA512
afe256d8d38b4dcfe5cf51ccb01ee852340fe460d0d2a874662cde87b214c9f9e4deb0cad7e51582bdb37a8c5bb7f3a9994b661c9b65efa5675d8e0d8c32834b
-
SSDEEP
3072:n4c+aFQGAOGWcroDwXrJsCkK3hYIQtHu1tW:nV+aFWOGWioDspzLmu1
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25E609E5-B259-11CF-BFC7-444553540000}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25E609E4-B259-11CF-BFC7-444553540000} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25E609E4-B259-11CF-BFC7-444553540000}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25E609E5-B259-11CF-BFC7-444553540000} regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3664 regsvr32.exe 3664 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 3664 regsvr32.exe Token: SeCreateTokenPrivilege 3664 regsvr32.exe Token: SeAssignPrimaryTokenPrivilege 3664 regsvr32.exe Token: SeLockMemoryPrivilege 3664 regsvr32.exe Token: SeIncreaseQuotaPrivilege 3664 regsvr32.exe Token: SeMachineAccountPrivilege 3664 regsvr32.exe Token: SeTcbPrivilege 3664 regsvr32.exe Token: SeSecurityPrivilege 3664 regsvr32.exe Token: SeTakeOwnershipPrivilege 3664 regsvr32.exe Token: SeLoadDriverPrivilege 3664 regsvr32.exe Token: SeSystemProfilePrivilege 3664 regsvr32.exe Token: SeSystemtimePrivilege 3664 regsvr32.exe Token: SeProfSingleProcessPrivilege 3664 regsvr32.exe Token: SeIncBasePriorityPrivilege 3664 regsvr32.exe Token: SeCreatePagefilePrivilege 3664 regsvr32.exe Token: SeCreatePermanentPrivilege 3664 regsvr32.exe Token: SeBackupPrivilege 3664 regsvr32.exe Token: SeRestorePrivilege 3664 regsvr32.exe Token: SeShutdownPrivilege 3664 regsvr32.exe Token: SeDebugPrivilege 3664 regsvr32.exe Token: SeAuditPrivilege 3664 regsvr32.exe Token: SeSystemEnvironmentPrivilege 3664 regsvr32.exe Token: SeChangeNotifyPrivilege 3664 regsvr32.exe Token: SeRemoteShutdownPrivilege 3664 regsvr32.exe Token: SeUndockPrivilege 3664 regsvr32.exe Token: SeSyncAgentPrivilege 3664 regsvr32.exe Token: SeEnableDelegationPrivilege 3664 regsvr32.exe Token: SeManageVolumePrivilege 3664 regsvr32.exe Token: SeImpersonatePrivilege 3664 regsvr32.exe Token: SeCreateGlobalPrivilege 3664 regsvr32.exe Token: 31 3664 regsvr32.exe Token: 32 3664 regsvr32.exe Token: 33 3664 regsvr32.exe Token: 34 3664 regsvr32.exe Token: 35 3664 regsvr32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3664 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1432 wrote to memory of 3664 1432 regsvr32.exe 83 PID 1432 wrote to memory of 3664 1432 regsvr32.exe 83 PID 1432 wrote to memory of 3664 1432 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\80d3dacf98c8a87ce4934c771458c4d2ad1733b5208477046894926dcbf64f3e.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\80d3dacf98c8a87ce4934c771458c4d2ad1733b5208477046894926dcbf64f3e.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3664
-