9eedec7a4c14e97094097b333883a2c27de961be541a63bcd1a080cb702ae40b

Analysis

max time kernel
43s
max time network
51s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08/09/2022, 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

K3ICWorkFlow.dll
Size

40KB
MD5

114604af15ac092807342b607c113436
SHA1

657a7030742b1e743f5105b1b2cbce3e26b6284e
SHA256

98cd641881cd1e86deb98eb8bea2b349fcff2272e3fb6a9f4f928f358588ee6a
SHA512

04ab6c6acb386a5a4e1c9ce154f8b0b2141163699afa9de270828e61921c0b5ff112e5b2822593a273c65f8855139d47500ed6081036bff4a0e60837b744393b
SSDEEP

384:6aCKzWj9oR9T3Pt+U7Vooux1nB0XlKEX3Rcmt4ODL0s0rKXV28:Vt4u9TVVSx1nObH2G99XV2

Score

1^/10

Malware Config

Signatures

Modifies registry class 44 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4AC47988-77D8-4E22-B037-BEF306763DDC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4AC47988-77D8-4E22-B037-BEF306763DDC}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D0C6077C-6621-417D-B4AD-A4E76E7D9379}\ = "_CWorkFlow"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2315040-2017-4491-A7D8-72F9DBC59502}\ = "K3ICWorkFlow.CWorkFlow"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2315040-2017-4491-A7D8-72F9DBC59502}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4AC47988-77D8-4E22-B037-BEF306763DDC}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4AC47988-77D8-4E22-B037-BEF306763DDC}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D0C6077C-6621-417D-B4AD-A4E76E7D9379}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2315040-2017-4491-A7D8-72F9DBC59502}\ProgID\ = "K3ICWorkFlow.CWorkFlow"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\K3ICWorkFlow.CWorkFlow\Clsid\ = "{C2315040-2017-4491-A7D8-72F9DBC59502}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2315040-2017-4491-A7D8-72F9DBC59502}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4AC47988-77D8-4E22-B037-BEF306763DDC}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\K3ICWorkFlow.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D0C6077C-6621-417D-B4AD-A4E76E7D9379}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D0C6077C-6621-417D-B4AD-A4E76E7D9379}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2315040-2017-4491-A7D8-72F9DBC59502}\VERSION	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2315040-2017-4491-A7D8-72F9DBC59502}\VERSION\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D0C6077C-6621-417D-B4AD-A4E76E7D9379}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4AC47988-77D8-4E22-B037-BEF306763DDC}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D0C6077C-6621-417D-B4AD-A4E76E7D9379}\ = "_CWorkFlow"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D0C6077C-6621-417D-B4AD-A4E76E7D9379}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2315040-2017-4491-A7D8-72F9DBC59502}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4AC47988-77D8-4E22-B037-BEF306763DDC}\1.0\ = "K3ICWorkFlow"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4AC47988-77D8-4E22-B037-BEF306763DDC}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D0C6077C-6621-417D-B4AD-A4E76E7D9379}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2315040-2017-4491-A7D8-72F9DBC59502}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\K3ICWorkFlow.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\K3ICWorkFlow.CWorkFlow\ = "K3ICWorkFlow.CWorkFlow"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D0C6077C-6621-417D-B4AD-A4E76E7D9379}\ = "CWorkFlow"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D0C6077C-6621-417D-B4AD-A4E76E7D9379}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2315040-2017-4491-A7D8-72F9DBC59502}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\K3ICWorkFlow.CWorkFlow	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4AC47988-77D8-4E22-B037-BEF306763DDC}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{4AC47988-77D8-4E22-B037-BEF306763DDC}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D0C6077C-6621-417D-B4AD-A4E76E7D9379}\TypeLib\ = "{4AC47988-77D8-4E22-B037-BEF306763DDC}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D0C6077C-6621-417D-B4AD-A4E76E7D9379}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2315040-2017-4491-A7D8-72F9DBC59502}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2315040-2017-4491-A7D8-72F9DBC59502}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D0C6077C-6621-417D-B4AD-A4E76E7D9379}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D0C6077C-6621-417D-B4AD-A4E76E7D9379}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D0C6077C-6621-417D-B4AD-A4E76E7D9379}\TypeLib\ = "{4AC47988-77D8-4E22-B037-BEF306763DDC}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D0C6077C-6621-417D-B4AD-A4E76E7D9379}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2315040-2017-4491-A7D8-72F9DBC59502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2315040-2017-4491-A7D8-72F9DBC59502}\TypeLib\ = "{4AC47988-77D8-4E22-B037-BEF306763DDC}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\K3ICWorkFlow.CWorkFlow\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D0C6077C-6621-417D-B4AD-A4E76E7D9379}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 916	1980	regsvr32.exe	28
PID 1980 wrote to memory of 916	1980	regsvr32.exe	28
PID 1980 wrote to memory of 916	1980	regsvr32.exe	28
PID 1980 wrote to memory of 916	1980	regsvr32.exe	28
PID 1980 wrote to memory of 916	1980	regsvr32.exe	28
PID 1980 wrote to memory of 916	1980	regsvr32.exe	28
PID 1980 wrote to memory of 916	1980	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\K3ICWorkFlow.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\K3ICWorkFlow.dll
  2⤵
  - Modifies registry class
  PID:916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-56-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1980-54-0x000007FEFC1B1000-0x000007FEFC1B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads