Analysis
-
max time kernel
94s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 09:38
Behavioral task
behavioral1
Sample
fd0813eb0e12916e6b381c59f6e74fd4a2667922483bc5331062ea6325f2597f.dll
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
fd0813eb0e12916e6b381c59f6e74fd4a2667922483bc5331062ea6325f2597f.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
fd0813eb0e12916e6b381c59f6e74fd4a2667922483bc5331062ea6325f2597f.dll
-
Size
176KB
-
MD5
9be160537528b5d39f3f38214d0ae565
-
SHA1
2383c37b1adbe058a099dd25eebb019896c54bb0
-
SHA256
fd0813eb0e12916e6b381c59f6e74fd4a2667922483bc5331062ea6325f2597f
-
SHA512
b6a0a2030c68efe85ae1fce4eeffe6e90366653b19d9d57c294c7462e37646280aeae3bf0a076d78210e5b31a231e4ad7bef736140080ed2f86d652172f6b388
-
SSDEEP
3072:a4c+aFQGAOGWcroDwXrJsCkK3hYIQtHu1tW:aV+aFWOGWioDspzLmu1
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25E609E5-B259-11CF-BFC7-444553540000} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25E609E5-B259-11CF-BFC7-444553540000}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25E609E4-B259-11CF-BFC7-444553540000} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25E609E4-B259-11CF-BFC7-444553540000}\InProcServer32 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2480 regsvr32.exe 2480 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 2480 regsvr32.exe Token: SeCreateTokenPrivilege 2480 regsvr32.exe Token: SeAssignPrimaryTokenPrivilege 2480 regsvr32.exe Token: SeLockMemoryPrivilege 2480 regsvr32.exe Token: SeIncreaseQuotaPrivilege 2480 regsvr32.exe Token: SeMachineAccountPrivilege 2480 regsvr32.exe Token: SeTcbPrivilege 2480 regsvr32.exe Token: SeSecurityPrivilege 2480 regsvr32.exe Token: SeTakeOwnershipPrivilege 2480 regsvr32.exe Token: SeLoadDriverPrivilege 2480 regsvr32.exe Token: SeSystemProfilePrivilege 2480 regsvr32.exe Token: SeSystemtimePrivilege 2480 regsvr32.exe Token: SeProfSingleProcessPrivilege 2480 regsvr32.exe Token: SeIncBasePriorityPrivilege 2480 regsvr32.exe Token: SeCreatePagefilePrivilege 2480 regsvr32.exe Token: SeCreatePermanentPrivilege 2480 regsvr32.exe Token: SeBackupPrivilege 2480 regsvr32.exe Token: SeRestorePrivilege 2480 regsvr32.exe Token: SeShutdownPrivilege 2480 regsvr32.exe Token: SeDebugPrivilege 2480 regsvr32.exe Token: SeAuditPrivilege 2480 regsvr32.exe Token: SeSystemEnvironmentPrivilege 2480 regsvr32.exe Token: SeChangeNotifyPrivilege 2480 regsvr32.exe Token: SeRemoteShutdownPrivilege 2480 regsvr32.exe Token: SeUndockPrivilege 2480 regsvr32.exe Token: SeSyncAgentPrivilege 2480 regsvr32.exe Token: SeEnableDelegationPrivilege 2480 regsvr32.exe Token: SeManageVolumePrivilege 2480 regsvr32.exe Token: SeImpersonatePrivilege 2480 regsvr32.exe Token: SeCreateGlobalPrivilege 2480 regsvr32.exe Token: 31 2480 regsvr32.exe Token: 32 2480 regsvr32.exe Token: 33 2480 regsvr32.exe Token: 34 2480 regsvr32.exe Token: 35 2480 regsvr32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2480 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1944 wrote to memory of 2480 1944 regsvr32.exe 84 PID 1944 wrote to memory of 2480 1944 regsvr32.exe 84 PID 1944 wrote to memory of 2480 1944 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\fd0813eb0e12916e6b381c59f6e74fd4a2667922483bc5331062ea6325f2597f.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\fd0813eb0e12916e6b381c59f6e74fd4a2667922483bc5331062ea6325f2597f.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2480
-