Overview
overview
10Static
static
3tera1.zip
windows10-2004-x64
100a4scandoc.exe
windows10-2004-x64
107z.dll
windows10-2004-x64
3AppointmentApis.dll
windows10-2004-x64
1Microsoft....ty.dll
windows10-2004-x64
1WINSSNAP.dll
windows10-2004-x64
1appraiser.dll
windows10-2004-x64
1msvcr100.dll
windows10-2004-x64
3wlanpref.dll
windows10-2004-x64
1wxmsw32u_x...om.dll
windows10-2004-x64
1Analysis
-
max time kernel
125s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-09-2024 20:56
Static task
static1
Behavioral task
behavioral1
Sample
tera1.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
0a4scandoc.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
7z.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
AppointmentApis.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Microsoft.PowerShell.Commands.Utility.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
WINSSNAP.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
appraiser.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
msvcr100.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
wlanpref.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
wxmsw32u_xrc_gcc_custom.dll
Resource
win10v2004-20240802-en
General
-
Target
wlanpref.dll
-
Size
761KB
-
MD5
f4565a6b8c00030593d97f0b0f81c976
-
SHA1
64f458130ff95253317f37f500978eefd9cadfde
-
SHA256
190536922fb9cd91b778011811260c67c0b24fcd84f5ea7487557ae6729b3cc6
-
SHA512
79bfadc865b3dc8295987f3cabbedc836c4aedbfcfab9f798b71933d0e4105bd2b043fab16e787167147990f2e18ece642caccacda95ad5fa67059dcd33b1fe8
-
SSDEEP
12288:DnbMJ3P4SJL0tiB1gaCz47/4CD/Qtn47/4C9mCHDd:L5G4icuIOf
Malware Config
Signatures
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WlanPref.WlanPrefLUA.1\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WlanPref.WlanPrefLUA.1 regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\wlanpref.dll1⤵
- Modifies registry class
PID:220
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4340,i,1729213506309163284,12809566808978835441,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:81⤵PID:1148