Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 16:32
Behavioral task
behavioral1
Sample
2621a6680b000c2abe868319e6d3db455d40fd03668462bf01ec507ffde5a18e.dll
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2621a6680b000c2abe868319e6d3db455d40fd03668462bf01ec507ffde5a18e.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
2621a6680b000c2abe868319e6d3db455d40fd03668462bf01ec507ffde5a18e.dll
-
Size
176KB
-
MD5
13ebd617581640d1d361bddfa940ec2a
-
SHA1
6cc7aad29c3463d9a12b40a82a2a8e12b1b23738
-
SHA256
2621a6680b000c2abe868319e6d3db455d40fd03668462bf01ec507ffde5a18e
-
SHA512
f81ca90e8070691544e2a0b6f7c10575a8fac8ef14eabd8625bf4e1564aa244440ebb620aef584e2f16f08505ea9dff09e95a55e8031521daaa282d38bfa1fd9
-
SSDEEP
3072:F4c+aFQGAOGWcroDwXrJsCkK3hYIQtHu1tW:FV+aFWOGWioDspzLmu1
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E4-B259-11CF-BFC7-444553540000}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E5-B259-11CF-BFC7-444553540000} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E5-B259-11CF-BFC7-444553540000}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25E609E4-B259-11CF-BFC7-444553540000} regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2300 regsvr32.exe 2300 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 2300 regsvr32.exe Token: SeCreateTokenPrivilege 2300 regsvr32.exe Token: SeAssignPrimaryTokenPrivilege 2300 regsvr32.exe Token: SeLockMemoryPrivilege 2300 regsvr32.exe Token: SeIncreaseQuotaPrivilege 2300 regsvr32.exe Token: SeMachineAccountPrivilege 2300 regsvr32.exe Token: SeTcbPrivilege 2300 regsvr32.exe Token: SeSecurityPrivilege 2300 regsvr32.exe Token: SeTakeOwnershipPrivilege 2300 regsvr32.exe Token: SeLoadDriverPrivilege 2300 regsvr32.exe Token: SeSystemProfilePrivilege 2300 regsvr32.exe Token: SeSystemtimePrivilege 2300 regsvr32.exe Token: SeProfSingleProcessPrivilege 2300 regsvr32.exe Token: SeIncBasePriorityPrivilege 2300 regsvr32.exe Token: SeCreatePagefilePrivilege 2300 regsvr32.exe Token: SeCreatePermanentPrivilege 2300 regsvr32.exe Token: SeBackupPrivilege 2300 regsvr32.exe Token: SeRestorePrivilege 2300 regsvr32.exe Token: SeShutdownPrivilege 2300 regsvr32.exe Token: SeDebugPrivilege 2300 regsvr32.exe Token: SeAuditPrivilege 2300 regsvr32.exe Token: SeSystemEnvironmentPrivilege 2300 regsvr32.exe Token: SeChangeNotifyPrivilege 2300 regsvr32.exe Token: SeRemoteShutdownPrivilege 2300 regsvr32.exe Token: SeUndockPrivilege 2300 regsvr32.exe Token: SeSyncAgentPrivilege 2300 regsvr32.exe Token: SeEnableDelegationPrivilege 2300 regsvr32.exe Token: SeManageVolumePrivilege 2300 regsvr32.exe Token: SeImpersonatePrivilege 2300 regsvr32.exe Token: SeCreateGlobalPrivilege 2300 regsvr32.exe Token: 31 2300 regsvr32.exe Token: 32 2300 regsvr32.exe Token: 33 2300 regsvr32.exe Token: 34 2300 regsvr32.exe Token: 35 2300 regsvr32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2300 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2300 3044 regsvr32.exe 30 PID 3044 wrote to memory of 2300 3044 regsvr32.exe 30 PID 3044 wrote to memory of 2300 3044 regsvr32.exe 30 PID 3044 wrote to memory of 2300 3044 regsvr32.exe 30 PID 3044 wrote to memory of 2300 3044 regsvr32.exe 30 PID 3044 wrote to memory of 2300 3044 regsvr32.exe 30 PID 3044 wrote to memory of 2300 3044 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2621a6680b000c2abe868319e6d3db455d40fd03668462bf01ec507ffde5a18e.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2621a6680b000c2abe868319e6d3db455d40fd03668462bf01ec507ffde5a18e.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2300
-