25f926c8b5ce475f09b806c9315690ab4ebcf31374301046065677826ff57e15

Analysis

max time kernel
18s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ISTactivex.dll
Size

60KB
MD5

4a4c0d53708c0aa4e08f4bb60cc9ebd4
SHA1

891a22a8364660614723859afa12714783c180f4
SHA256

9b170fa3e306477baef10228612328c91a3349653ae042fe2358783f12cdca95
SHA512

008b307faf090e30b8b628b2a9623af838f0b2b94b0d0b9f403343a5f55a94dc08328bddcb32dfdcb37c9f7512ca6a067ad3cbc3109e1c19b831dc5d227c35d8
SSDEEP

768:Q/T1MNfT7b0cZK11hvDjF7A1JX+lrKVOvOc8bJlg1BzZl1vUsHQ:QLWbj8Ba1JXQrKcJ6m1pn1HHQ

Score

1^/10

Malware Config

Signatures

Modifies registry class 35 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67907B3C-A6EF-4A01-99AD-3FCD5F526429}\1.1\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ISTactivex.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0985C112-2562-46F2-8DA6-92648BA4630F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0985C112-2562-46F2-8DA6-92648BA4630F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0985C112-2562-46F2-8DA6-92648BA4630F}\ = "IInstaller"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C559105-9ECF-42b8-B3F7-832E75EDD959}\ = "Installer Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67907B3C-A6EF-4A01-99AD-3FCD5F526429}\1.1\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0985C112-2562-46F2-8DA6-92648BA4630F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0985C112-2562-46F2-8DA6-92648BA4630F}\TypeLib\ = "{67907B3C-A6EF-4A01-99AD-3FCD5F526429}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0985C112-2562-46F2-8DA6-92648BA4630F}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0985C112-2562-46F2-8DA6-92648BA4630F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0985C112-2562-46F2-8DA6-92648BA4630F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0985C112-2562-46F2-8DA6-92648BA4630F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ISTx.Installer\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C559105-9ECF-42b8-B3F7-832E75EDD959}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67907B3C-A6EF-4A01-99AD-3FCD5F526429}\1.1\ = "IST 1.1 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67907B3C-A6EF-4A01-99AD-3FCD5F526429}\1.1\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67907B3C-A6EF-4A01-99AD-3FCD5F526429}\1.1\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0985C112-2562-46F2-8DA6-92648BA4630F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ISTx.Installer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67907B3C-A6EF-4A01-99AD-3FCD5F526429}\1.1\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0985C112-2562-46F2-8DA6-92648BA4630F}\TypeLib\ = "{67907B3C-A6EF-4A01-99AD-3FCD5F526429}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ISTx.Installer\ = "Installer Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ISTx.Installer\CLSID\ = "{7C559105-9ECF-42b8-B3F7-832E75EDD959}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C559105-9ECF-42b8-B3F7-832E75EDD959}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ISTactivex.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0985C112-2562-46F2-8DA6-92648BA4630F}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0985C112-2562-46F2-8DA6-92648BA4630F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C559105-9ECF-42b8-B3F7-832E75EDD959}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C559105-9ECF-42b8-B3F7-832E75EDD959}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C559105-9ECF-42b8-B3F7-832E75EDD959}\ProgID\ = "ISTx.Installer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67907B3C-A6EF-4A01-99AD-3FCD5F526429}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67907B3C-A6EF-4A01-99AD-3FCD5F526429}\1.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67907B3C-A6EF-4A01-99AD-3FCD5F526429}\1.1\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C559105-9ECF-42b8-B3F7-832E75EDD959}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67907B3C-A6EF-4A01-99AD-3FCD5F526429}\1.1\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0985C112-2562-46F2-8DA6-92648BA4630F}\ = "IInstaller"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1488	1940	regsvr32.exe	27
PID 1940 wrote to memory of 1488	1940	regsvr32.exe	27
PID 1940 wrote to memory of 1488	1940	regsvr32.exe	27
PID 1940 wrote to memory of 1488	1940	regsvr32.exe	27
PID 1940 wrote to memory of 1488	1940	regsvr32.exe	27
PID 1940 wrote to memory of 1488	1940	regsvr32.exe	27
PID 1940 wrote to memory of 1488	1940	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ISTactivex.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ISTactivex.dll
  2⤵
  - Modifies registry class
  PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-56-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/1940-54-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads