Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/12/2024, 21:47
Behavioral task
behavioral1
Sample
035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll
Resource
win7-20240903-en
General
-
Target
035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll
-
Size
1.4MB
-
MD5
3b97ff9df423e25e55e619ab25aec98d
-
SHA1
3abf7065c456f1f0f731492b085709e17b8bad37
-
SHA256
035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d
-
SHA512
409635d198d5732094dd1e7b99d0386f8fe9d9fe710cfc6b5565de3a42c24b6ca7196f63192a34ef59969f5c52cd010944cd713e0af0f6f1fc52c0c3315893f5
-
SSDEEP
24576:SKit4aTOnCoUHbYbDzjJcvvNmIMlSE/p/SZjAygfc87LnwgT69gvmzmTWb:Bit7Onr8YVyNmdUEJSpkfvQgTsgvmB
Malware Config
Signatures
-
Ramnit family
-
Executes dropped EXE 1 IoCs
pid Process 2408 regsvr32mgr.exe -
Loads dropped DLL 2 IoCs
pid Process 2384 regsvr32.exe 2384 regsvr32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe -
resource yara_rule behavioral1/files/0x000700000001211a-1.dat upx behavioral1/memory/2408-13-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2408-10-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2384-7-0x0000000073F30000-0x00000000742EA000-memory.dmp upx behavioral1/memory/2408-15-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2408-17-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/2408-19-0x0000000000400000-0x000000000045B000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32mgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21FEC851-BB2E-11EF-8CD3-5EE01BAFE073} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440461095" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2205EC71-BB2E-11EF-8CD3-5EE01BAFE073} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Modifies registry class 62 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup\ = "VesnErrorLookup Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net\CLSID\ = "{DB000001-1979-2001-2013-121388DB0001}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\ExtendedErrors regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\ = "VesnErrorLookup Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\InprocServer32\ThreadingModel = "apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup.1.0\ = "VesnErrorLookup Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\AppID = "{844B00E1-3509-4380-9963-9D58E98E5AEC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\OLE DB Provider regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup\CurVer\ = "VesnErrorLookup.VesnErrorLookup.1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\ = "VesnDBClient Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net\CurVer\ = "VesnDB.Net.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup\CLSID\ = "{653E37B1-9233-4435-96A2-60BAAD136F83}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\VersionIndependentProgID\ = "VesnErrorLookup.VesnErrorLookup" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\ExtendedErrors\{653E37B1-9233-4435-96A2-60BAAD136F83}\ = "VesnDB.Net Provider Error Lookup Service" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\ = "VesnDB.Net" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\ProgID\ = "VesnDB.Net.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\VesnDB.DLL\AppID = "{DB000001-1979-2001-2013-121388DB000A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup.1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\ExtendedErrors\{653E37B1-9233-4435-96A2-60BAAD136F83} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup.1.0\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net.1\CLSID\ = "{DB000001-1979-2001-2013-121388DB0001}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\VersionIndependentProgID\ = "VesnDB.Net Provider" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\OLE DB Provider\ = "VesnDB.Net Provider" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{DB000001-1979-2001-2013-121388DB000A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\VesnDB.DLL regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\AppID = "{844B00E1-3509-4380-9963-9D58E98E5AEC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnErrorLookup.VesnErrorLookup.1.0\CLSID\ = "{653E37B1-9233-4435-96A2-60BAAD136F83}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{DB000001-1979-2001-2013-121388DB000A}\ = "VesnDB" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\TypeLib\ = "{844B00E1-3509-4380-9963-9D58E98E5AEC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net.1\ = "VesnDB.Net Provider" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB000001-1979-2001-2013-121388DB0001}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{844B00E1-3509-4380-9963-9D58E98E5AEC}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{653E37B1-9233-4435-96A2-60BAAD136F83}\ProgID\ = "VesnErrorLookup.VesnErrorLookup.1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VesnDB.Net\ = "VesnDB.Net Provider" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2408 regsvr32mgr.exe 2408 regsvr32mgr.exe 2408 regsvr32mgr.exe 2408 regsvr32mgr.exe 2408 regsvr32mgr.exe 2408 regsvr32mgr.exe 2408 regsvr32mgr.exe 2408 regsvr32mgr.exe 2384 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2408 regsvr32mgr.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2420 iexplore.exe 1656 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2420 iexplore.exe 2420 iexplore.exe 1656 iexplore.exe 1656 iexplore.exe 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2384 2100 regsvr32.exe 30 PID 2100 wrote to memory of 2384 2100 regsvr32.exe 30 PID 2100 wrote to memory of 2384 2100 regsvr32.exe 30 PID 2100 wrote to memory of 2384 2100 regsvr32.exe 30 PID 2100 wrote to memory of 2384 2100 regsvr32.exe 30 PID 2100 wrote to memory of 2384 2100 regsvr32.exe 30 PID 2100 wrote to memory of 2384 2100 regsvr32.exe 30 PID 2384 wrote to memory of 2408 2384 regsvr32.exe 31 PID 2384 wrote to memory of 2408 2384 regsvr32.exe 31 PID 2384 wrote to memory of 2408 2384 regsvr32.exe 31 PID 2384 wrote to memory of 2408 2384 regsvr32.exe 31 PID 2408 wrote to memory of 2420 2408 regsvr32mgr.exe 32 PID 2408 wrote to memory of 2420 2408 regsvr32mgr.exe 32 PID 2408 wrote to memory of 2420 2408 regsvr32mgr.exe 32 PID 2408 wrote to memory of 2420 2408 regsvr32mgr.exe 32 PID 2408 wrote to memory of 1656 2408 regsvr32mgr.exe 33 PID 2408 wrote to memory of 1656 2408 regsvr32mgr.exe 33 PID 2408 wrote to memory of 1656 2408 regsvr32mgr.exe 33 PID 2408 wrote to memory of 1656 2408 regsvr32mgr.exe 33 PID 2420 wrote to memory of 2804 2420 iexplore.exe 34 PID 2420 wrote to memory of 2804 2420 iexplore.exe 34 PID 2420 wrote to memory of 2804 2420 iexplore.exe 34 PID 2420 wrote to memory of 2804 2420 iexplore.exe 34 PID 1656 wrote to memory of 3012 1656 iexplore.exe 35 PID 1656 wrote to memory of 3012 1656 iexplore.exe 35 PID 1656 wrote to memory of 3012 1656 iexplore.exe 35 PID 1656 wrote to memory of 3012 1656 iexplore.exe 35
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\035ed5fcdd134622ded390da86e37ffac971905351523824cfb9944a3a71d81d.dll2⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2804
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3012
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54735e6cff0bd309124e9c89bce86872c
SHA1fc2731cb992bc049a942015b90e3a399e11fa88c
SHA2560a95a83e1972ca8ed7c74cc8c984af7c258491bb1ef8edf6f2cee4f0a30bdf65
SHA5122ffb9c0e52c4b762319851318d00f6c22c80a139d121257cfb82f43812d91e2682ccf7ee4742851e13e5065977c5b1faaf1d86b6e6f524ca9d413520a26f6d9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c7d1bdb8c018500a2c40ff61b1d463e
SHA1f7d9e50bfad61d72dbf8b9de53b6429b4934deac
SHA256a7f6497a508ba5ba6a5ffcd67c91c7eae0f73326671f22f9195cd8dde406f9c2
SHA5126c86248f62221a6cb6fb1f3a9cce8663725e923881c18d622edec84933bed9dda1d8d1c77ec34c2f6843b974931d53734fe0a6aa6b0296219d181e3d6a24a2a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd26ab4d31b87d4db9549f16e3136162
SHA15bbd864f9efc7b16f0f65cb80add345aa730d7fb
SHA256e759fc427c2ce546a1f673e611f940d40efaba5fe39527037bae3b6ecc37c052
SHA512c0dc9a1b92789b8d446de319c9db9869232788fc2f4c31286e9b78c237d81bbf441cd44ff8d0f1b9bbda996f91cfac481d3e7281b22967b12ac8fc90a27fd863
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aef029c7975eb08e9b51d3ae79316210
SHA1aa0eba52b39e58bf162090f2a9bdc838df80f042
SHA2563f9381231bdc3bc3714c56ba79ce06bd96396d4b81ba0df37f310bfcf59bddd4
SHA512290620a5b546df887bcb40fb49b0b1f11705497b3c4e7af867a80e0fa5cba5f2cfbc0c3f46272d543336e153bd30882072edb441d5f88a6dcfae563e06d7edfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5388c6522d41dcd1bf6299a4c3529323d
SHA1518c753b39ef9ee352e4c4064f5e73962da082c6
SHA2564455159ca0f58fa768be6307fe05250dd98533cd27325db93043be37d17858aa
SHA5126985157dad03eec0a3c495aaabe7a790ce9828813431ec6b523276b925ffdc1e1496ccc79a9ac7f512d887d035435793ad626fc41f88269d41d8256a2f94b806
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522a6d3937e50a2bd51fbf2a244b24a2c
SHA1c3668ec4d3497243946ead9ec663abf1dd0ba33d
SHA256bf0b1be451a500f1df7877da5d05c30cabbffdd2d50311f349debc8a20903e70
SHA512a7f4319fc29d99c7d9f13baab94c8b834e7d3805e733500f57764d3a3189ac12d70bb0ed64ce10b21c08a48d87be586f129457018207cfaa7f163107769c4ec7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53225a9fc6aa7a780f47e982d05044662
SHA1879961814fd804c84131206afad14205459dad09
SHA256b74e5c7a699823b854023f52b6d33836d44a9f1c06310d0a7b79354788b459f0
SHA512493b802e04dc2fc46125ab6986c7d324e75b1fe71bc4c316ca0a8d1a86f28232a3d91b5b565b181768c6acd60b6e701523b4200c4a2094fd0a01fa112f9b3dbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e3825c0a3597dbde4cbcca42eaf7e3e
SHA1d8f4ce0ec51b01fe5fdd1b09c13c6ed0acc9a483
SHA256419cfb92ef407eba7afc22e7e399244beeb7c97b185be526b9390535846fc8bf
SHA512d9b1a3d7b61e0d7c87957f0255caa9d456b22d71bc7f59fa8d0261626138d83ef4080cddb7129d140497da8c1427ea9b62267d2e942de212050002ee6dc84e73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa8fd57829fc4210c5101e844ffadc44
SHA12f135a5f3de36f630c0afd9935273c04d2cc7f2c
SHA2566f259526dc8e0fb3d386838a9922f2a47201b634368295329262f0c9f64dd5c8
SHA5126acfb46eec5abfa20d9f511932aa83e78ed076fc4d67fa46dd6f8381753bf87c2f566ca7d426327124107c0074d70997eb93873ce60a2a4cbaab2730ba49e713
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5567a0576d7e02c9e20da51ea7a57645c
SHA19bbd2ca25f762005cbe8a3fbd431fa40d0f21b55
SHA256e8205b2509605659f61560737d9180c905b71cf2d070e31f815ea97a75e0fe9c
SHA512c1b77348f231ddeae0df256e07a6598963a8a47c3933af94c32c403eae5aa415f1b60febf80068db71c57d1732c414b456208e08a4e7075de8399c80d8abdfdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c19fe8a9fcb7a3167040b06dcd2d7a97
SHA173771ac3be4fc3a625590c1c7a66aa691e2b55ff
SHA256c47c4bc95bcb76a5677d0d392ccf0912dd2f04353c4be8004dae4e0a6fc7dcd0
SHA5122be2914622d3efa41b9fb94e2aeba178b94710fb771514f732b7ed375a65e5d9784240a907cfe43abf1f3d8eaaad2f4c7a603265d7450d8c7afc920e4be10181
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54395b014ebe10511ce31054e2b2b94ba
SHA1786fd5a252e136e514ad1e95274afc708dd5939e
SHA256640b0921cf4126765846ca064a2334e7863b742132b2c215dc0621032ffb43bc
SHA512dbaa8a370c4da1fa38d456fb97409765e038b01b53f231fb8526e81f597e754f53c4d2bb2845c10e7adbd70d759728b7678b2b05f988af26584c9e3a3f33945e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bd9c5d2bcfdcd3c00a30e3f86a2d6cb
SHA1ea2d993ac43fa7fc3b8aea834a9386d32607fc61
SHA256a194ea4721a5f9da92b228dc261502f96021e09248b04993604763806ac4e80d
SHA5123d2e0f05bf8ad4eb708c5d5dbc5f6f8ac6d2816768fb433e14d59d4d1c3b2f9ba617d4858f75b8aa44d7e81312d7886cb95731fda6e9b57a16ca2ec672d6e0ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6b588385ff8b07feb33f3e87059b822
SHA19c86831182e7047ecdf545d4ae6ec3c88202c3f2
SHA256e8dfe58dd4e349df7f7a4caa48ef4a8fd9d791e36d07797d2d11e9905e3a352b
SHA512e52908e9e7f1ad5d2de81d5154f353096db1175d189e97068171a949edaab4c2ace07c63beac6da99db79148621bcdfdc03dbd84ab35fe84dac82d63f2d7f1ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543c0c9e9fca6087c55999ea7396b2716
SHA1b3e62cdde0ba17687f4ac3444345187e8214e8db
SHA2560a8b914bf03845b0260e9f4f0e5758693365c331df4c72252e19827ec968ce3a
SHA5124506990b9600bd7c36aa9d16a20a9a57d0cb04d160c94e780c0ff4e5ac4e514ed27db0289c164e7a5a349cb6c4ede249cc7cd8dcb3a2c11a14602817a1ad85ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2f918df239757a6bec9f832caa4b2fb
SHA172696fd01280ed4d75a1257bf08025f30a9b82ee
SHA25649072af2fb9967a3a62122104fdc65b433b9446340b4bfa7b342ad783610be32
SHA512595b6d8276ceda1881508ccc732d68f2a162f2a79ca714499e19dda70f96403611e5ee08c299ca719b618f6b37fcbdebf443c6537b2cf7d2830accf2e383a3a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51758914bf45cb83a91bea80e0b7c3674
SHA19bae9d14efbec49dbb2d40f96f73fbacb10a2441
SHA256c45b102993066bb1094eb5448f374f5716379eb30d740c3d246ca051e3ab5679
SHA512abcece357a71304f3203eb874f8105357bc116f555a50bc735faab0f49c0f5fb32b4ac3dab0aa04f4599956b80f341daf1dba8f21456818a7776532d4502e93a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b37c2eadec47287d5ea53ebb703aa37
SHA128059103cefcc5974dfbe40ffa38d5cc9f3a3a20
SHA256353f86cce0bf6e758749de0ae1a1b0e777e2b7ffb90b70f4a1858e917a466c14
SHA512118e003dac92a9cce09c63da30276ddc0f3cbbe95f7b0103f761b7205fcf5e53eee6ec427bc140081149e581acf6a33fcc82e154855dc28149d3986eb8c9d76c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56dded085d74f5b43f21dfc87ef006083
SHA10389a17eadfc664ed8626819d3533088f0473cc0
SHA25642c9fb61aa00cd05e736b1da01a26f87d8b3e7933937e16e93111c8c4224a49d
SHA51231e45cae9baef0e33d8257695be499c2793e689a9c2527a0fd27987cec6a637300b7ac35906e29fa61c5978d434f9b2927237f5f7f4427733b8f0765841a2ff7
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{21FEC851-BB2E-11EF-8CD3-5EE01BAFE073}.dat
Filesize5KB
MD57af07f32852dbe1003c2bfbc36fb6431
SHA173bdbe2e680635bf0e1c90f927e6858a47b08fa9
SHA256f73c8bb8e92bee1deb5901a0ea8a9c755ce3f77846b47d3bcd6b6c69ec63872a
SHA512d00bee6b2e738e852f582dfdbbd9f2ac087a29f5e3ccb49bfc88ec3b6768736c9b89afbbeed1d9b53b5635b2de9d018b8f7a48abab77932448c55b12ff412990
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
105KB
MD5dfb5daabb95dcfad1a5faf9ab1437076
SHA14a199569a9b52911bee7fb19ab80570cc5ff9ed1
SHA25654282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0
SHA5125d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8