3b5b2300339fd2ff82f0dc567115d595a858bf0c17108629d9770e6d010b0ee3

General

Target

3b5b2300339fd2ff82f0dc567115d595a858bf0c17108629d9770e6d010b0ee3.dll
Size

708KB
MD5

092579157a64a40e4e51800705290d4a
SHA1

c2e71a77d11a18b685295b09c3b5c63e831f7033
SHA256

3b5b2300339fd2ff82f0dc567115d595a858bf0c17108629d9770e6d010b0ee3
SHA512

f45dc7d41b9ef3770c813a99b05ca60ecb2c43be2ea0591b52a88c8ebb689126da7d49804d3ea1f03ffb79caf97ed140c2324a5609d6fc85a3ea6ec6d90460ee

Score

1^/10

Malware Config

Signatures

Modifies registry class 41 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\ = "Aracaze"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\Control\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\TypeLib\ = "{F7E15119-55A1-C5BD-FD9B-43E211D65DF8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\Version\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F7E15119-55A1-C5BD-FD9B-43E211D65DF8}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F7E15119-55A1-C5BD-FD9B-43E211D65DF8}\1.0\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F7E15119-55A1-C5BD-FD9B-43E211D65DF8}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\InProcServer32\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\InProcServer32\ = "%SystemRoot%\\SysWow64\\shell32.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F7E15119-55A1-C5BD-FD9B-43E211D65DF8}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F7E15119-55A1-C5BD-FD9B-43E211D65DF8}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F7E15119-55A1-C5BD-FD9B-43E211D65DF8}\1.0\FLAGS\ = "4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F7E15119-55A1-C5BD-FD9B-43E211D65DF8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\Version\ = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\VersionIndependentProgID\ = "Shell.FolderView"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F7E15119-55A1-C5BD-FD9B-43E211D65DF8}\1.0\0\win32\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\TypeLib\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\VersionIndependentProgID\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\MiscStatus\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F7E15119-55A1-C5BD-FD9B-43E211D65DF8}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F7E15119-55A1-C5BD-FD9B-43E211D65DF8}\1.0\FLAGS\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F7E15119-55A1-C5BD-FD9B-43E211D65DF8}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\ProgID\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\ToolboxBitmap32\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F7E15119-55A1-C5BD-FD9B-43E211D65DF8}\1.0\ = "GrooveProjectMeetingDataDelegate"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F7E15119-55A1-C5BD-FD9B-43E211D65DF8}\1.0\0\win32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\GROOVE.EXE\\43"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\ProgID\ = "Shell.FolderView.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\ToolboxBitmap32\ = "%SystemRoot%\\SysWow64\\shell32.dll, 260"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F7E15119-55A1-C5BD-FD9B-43E211D65DF8}\1.0\0\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F7E15119-55A1-C5BD-FD9B-43E211D65DF8}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F7E15119-55A1-C5BD-FD9B-43E211D65DF8}\1.0\HELPDIR\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFBE6D2C-400B-441C-67A3-9F89D69D15DC}\TypeLib	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1472 wrote to memory of 1724	1472	regsvr32.exe	regsvr32.exe
PID 1472 wrote to memory of 1724	1472	regsvr32.exe	regsvr32.exe
PID 1472 wrote to memory of 1724	1472	regsvr32.exe	regsvr32.exe
PID 1472 wrote to memory of 1724	1472	regsvr32.exe	regsvr32.exe
PID 1472 wrote to memory of 1724	1472	regsvr32.exe	regsvr32.exe
PID 1472 wrote to memory of 1724	1472	regsvr32.exe	regsvr32.exe
PID 1472 wrote to memory of 1724	1472	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3b5b2300339fd2ff82f0dc567115d595a858bf0c17108629d9770e6d010b0ee3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\3b5b2300339fd2ff82f0dc567115d595a858bf0c17108629d9770e6d010b0ee3.dll
2⤵
- Modifies registry class
PID:1724

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1472-54-0x000007FEFB971000-0x000007FEFB973000-memory.dmp

Filesize
8KB

Download
memory/1724-55-0x0000000000000000-mapping.dmp

Download
memory/1724-56-0x0000000074F21000-0x0000000074F23000-memory.dmp

Filesize
8KB

Download
memory/1724-57-0x0000000011000000-0x00000000111A8000-memory.dmp

Filesize
1.7MB

Download
memory/1724-58-0x00000000008C0000-0x0000000000914000-memory.dmp

Filesize
336KB

Download
memory/1724-59-0x0000000003650000-0x0000000003665000-memory.dmp

Filesize
84KB

Download
memory/1724-60-0x00000000008C0000-0x0000000000914000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads