82f26b74d78f2505b962f422407afcfd9d1447ee2a6b99d43ec7c735a32fa225

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ie/MediaWatchV1home3067.dll
Size

85KB
MD5

884a0836632d534cfab902fcef21595c
SHA1

449dba152c3e801a58af2c6f531eb84edbd9d1ba
SHA256

345b7dd2d8cd5696f9e4af75b4d0b61a0462bdc780d4c93321c1f2ec858ea4c1
SHA512

e4adcc9dd2d686570e5249d68b9e48eb03851ef5915e2097e874ded51ffaf116752ae1a77cd72e46c9c180606b89b9999fe5e988a9dfaed225397a1a0d6d0538
SSDEEP

1536:e8/1CsEmka04RhRtahrOb8Dkhw6HA9glQMbdx:p12mka0ElahrOc6guaMbd

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2094dc86-dda0-497a-a339-0a09b0b6a0a8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2094dc86-dda0-497a-a339-0a09b0b6a0a8}\ = "MediaWatchV1home3067"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2094dc86-dda0-497a-a339-0a09b0b6a0a8}\NoExplorer = "1"	regsvr32.exe

Modifies registry class 34 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85BC2AC3-6C7D-41EA-8C3D-9A68BCC724FD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2094dc86-dda0-497a-a339-0a09b0b6a0a8}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2094dc86-dda0-497a-a339-0a09b0b6a0a8}\TypeLib\ = "{fbc8ae0d-6850-4703-b1c5-080b4df7c2e1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBC8AE0D-6850-4703-B1C5-080B4DF7C2E1}\1.1\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBC8AE0D-6850-4703-B1C5-080B4DF7C2E1}\1.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85BC2AC3-6C7D-41EA-8C3D-9A68BCC724FD}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85BC2AC3-6C7D-41EA-8C3D-9A68BCC724FD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85BC2AC3-6C7D-41EA-8C3D-9A68BCC724FD}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2094dc86-dda0-497a-a339-0a09b0b6a0a8}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2094dc86-dda0-497a-a339-0a09b0b6a0a8}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85BC2AC3-6C7D-41EA-8C3D-9A68BCC724FD}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85BC2AC3-6C7D-41EA-8C3D-9A68BCC724FD}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2094dc86-dda0-497a-a339-0a09b0b6a0a8}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBC8AE0D-6850-4703-B1C5-080B4DF7C2E1}\1.1\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBC8AE0D-6850-4703-B1C5-080B4DF7C2E1}\1.1\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ie"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85BC2AC3-6C7D-41EA-8C3D-9A68BCC724FD}\ = "IMediaWatchV1home3067BHO"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85BC2AC3-6C7D-41EA-8C3D-9A68BCC724FD}\TypeLib\ = "{FBC8AE0D-6850-4703-B1C5-080B4DF7C2E1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85BC2AC3-6C7D-41EA-8C3D-9A68BCC724FD}\TypeLib\ = "{FBC8AE0D-6850-4703-B1C5-080B4DF7C2E1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBC8AE0D-6850-4703-B1C5-080B4DF7C2E1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBC8AE0D-6850-4703-B1C5-080B4DF7C2E1}\1.1\ = "MediaWatchV1home3067Lib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBC8AE0D-6850-4703-B1C5-080B4DF7C2E1}\1.1\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2094dc86-dda0-497a-a339-0a09b0b6a0a8}\ = "MediaWatchV1home3067"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85BC2AC3-6C7D-41EA-8C3D-9A68BCC724FD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85BC2AC3-6C7D-41EA-8C3D-9A68BCC724FD}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85BC2AC3-6C7D-41EA-8C3D-9A68BCC724FD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85BC2AC3-6C7D-41EA-8C3D-9A68BCC724FD}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2094dc86-dda0-497a-a339-0a09b0b6a0a8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ie\\MediaWatchV1home3067.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2094dc86-dda0-497a-a339-0a09b0b6a0a8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBC8AE0D-6850-4703-B1C5-080B4DF7C2E1}\1.1\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBC8AE0D-6850-4703-B1C5-080B4DF7C2E1}\1.1\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ie\\MediaWatchV1home3067.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85BC2AC3-6C7D-41EA-8C3D-9A68BCC724FD}\ = "IMediaWatchV1home3067BHO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2094dc86-dda0-497a-a339-0a09b0b6a0a8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2094dc86-dda0-497a-a339-0a09b0b6a0a8}\Version\ = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FBC8AE0D-6850-4703-B1C5-080B4DF7C2E1}\1.1\0\win32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3816 wrote to memory of 1800	3816	regsvr32.exe	regsvr32.exe
PID 3816 wrote to memory of 1800	3816	regsvr32.exe	regsvr32.exe
PID 3816 wrote to memory of 1800	3816	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ie\MediaWatchV1home3067.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3816

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\ie\MediaWatchV1home3067.dll
2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1800

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads