13992ee845148fadf7afa52574dd382461d5a9030e07061b952fcefcd85072de

Analysis

max time kernel
156s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13992ee845148fadf7afa52574dd382461d5a9030e07061b952fcefcd85072de.dll
Size

56KB
MD5

50cbf38ffbdca711ca086ce255a3d463
SHA1

fdcbf21c55ad6f00c7e53f4283120d47a356662c
SHA256

13992ee845148fadf7afa52574dd382461d5a9030e07061b952fcefcd85072de
SHA512

45cc46b54c49edb115a642149083435ba37c3ff6dcc9a969fac46f60caca5d17425fc2f7968c294a25e817f71f01de4c0ecde85f487049ff823860eb8d7412c0
SSDEEP

768:rzgyXfEZcULHJ1BoaBOPRABL+E3Est2g1fgUSxY+kkkyYEqBEy585eMk:3gnpB6PRkaAEsEgi/b7gEwmep

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ADsSID.1\ = "ADsSID Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2120299D-C50D-11D2-BC7E-00C04FD430AF}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{212029A9-C50D-11D2-BC7E-00C04FD430AF}\TypeLib\ = "{2120299D-C50D-11D2-BC7E-00C04FD430AF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{212029AE-C50D-11D2-BC7E-00C04FD430AF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ADsSecurity\CLSID\ = "{212029AA-C50D-11D2-BC7E-00C04FD430AF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{212029AA-C50D-11D2-BC7E-00C04FD430AF}\ProgID\ = "ADsSecurity.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2120299D-C50D-11D2-BC7E-00C04FD430AF}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{212029A9-C50D-11D2-BC7E-00C04FD430AF}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{212029AE-C50D-11D2-BC7E-00C04FD430AF}\TypeLib\ = "{2120299D-C50D-11D2-BC7E-00C04FD430AF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{212029AF-C50D-11D2-BC7E-00C04FD430AF}\ProgID\ = "ADsSID.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{212029AF-C50D-11D2-BC7E-00C04FD430AF}\InprocServer32\ThreadingModel = "both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2120299D-C50D-11D2-BC7E-00C04FD430AF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2120299D-C50D-11D2-BC7E-00C04FD430AF}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{212029AE-C50D-11D2-BC7E-00C04FD430AF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2120299D-C50D-11D2-BC7E-00C04FD430AF}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{212029A9-C50D-11D2-BC7E-00C04FD430AF}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{212029A9-C50D-11D2-BC7E-00C04FD430AF}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{212029A9-C50D-11D2-BC7E-00C04FD430AF}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ADsSecurity.1\ = "ADsSecurity Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{212029AF-C50D-11D2-BC7E-00C04FD430AF}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2120299D-C50D-11D2-BC7E-00C04FD430AF}\1.0\ = "ADsSecurity 2.5 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{212029A9-C50D-11D2-BC7E-00C04FD430AF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{212029A9-C50D-11D2-BC7E-00C04FD430AF}\TypeLib\ = "{2120299D-C50D-11D2-BC7E-00C04FD430AF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{212029AE-C50D-11D2-BC7E-00C04FD430AF}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{212029AE-C50D-11D2-BC7E-00C04FD430AF}\TypeLib\ = "{2120299D-C50D-11D2-BC7E-00C04FD430AF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ADsSID.1\CLSID\ = "{212029AF-C50D-11D2-BC7E-00C04FD430AF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ADsSID\CLSID\ = "{212029AF-C50D-11D2-BC7E-00C04FD430AF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{212029AF-C50D-11D2-BC7E-00C04FD430AF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{212029AF-C50D-11D2-BC7E-00C04FD430AF}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ADsSecurity\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{212029AA-C50D-11D2-BC7E-00C04FD430AF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{212029AA-C50D-11D2-BC7E-00C04FD430AF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13992E~1.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ADsSID.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{212029AA-C50D-11D2-BC7E-00C04FD430AF}\ = "ADsSecurity Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{212029A9-C50D-11D2-BC7E-00C04FD430AF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{212029A9-C50D-11D2-BC7E-00C04FD430AF}\ = "IADsSecurity"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{212029AE-C50D-11D2-BC7E-00C04FD430AF}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{212029A9-C50D-11D2-BC7E-00C04FD430AF}\ = "IADsSecurity"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{212029A9-C50D-11D2-BC7E-00C04FD430AF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{212029AA-C50D-11D2-BC7E-00C04FD430AF}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ADsSID\ = "ADsSID Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ADsSID\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{212029AF-C50D-11D2-BC7E-00C04FD430AF}\VersionIndependentProgID\ = "ADsSID"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{212029AA-C50D-11D2-BC7E-00C04FD430AF}\VersionIndependentProgID\ = "ADsSecurity"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2120299D-C50D-11D2-BC7E-00C04FD430AF}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2120299D-C50D-11D2-BC7E-00C04FD430AF}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{212029AE-C50D-11D2-BC7E-00C04FD430AF}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{212029AE-C50D-11D2-BC7E-00C04FD430AF}\ = "IADsSID"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ADsSecurity.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{212029AE-C50D-11D2-BC7E-00C04FD430AF}\ = "IADsSID"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{212029AE-C50D-11D2-BC7E-00C04FD430AF}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{212029AE-C50D-11D2-BC7E-00C04FD430AF}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{212029A9-C50D-11D2-BC7E-00C04FD430AF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ADsSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{212029AF-C50D-11D2-BC7E-00C04FD430AF}\ = "ADsSID Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{212029AF-C50D-11D2-BC7E-00C04FD430AF}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{212029A9-C50D-11D2-BC7E-00C04FD430AF}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{212029AE-C50D-11D2-BC7E-00C04FD430AF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{212029AE-C50D-11D2-BC7E-00C04FD430AF}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ADsSecurity.1\CLSID\ = "{212029AA-C50D-11D2-BC7E-00C04FD430AF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{212029AA-C50D-11D2-BC7E-00C04FD430AF}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{212029AA-C50D-11D2-BC7E-00C04FD430AF}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{212029AA-C50D-11D2-BC7E-00C04FD430AF}\InprocServer32\ThreadingModel = "both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{212029AE-C50D-11D2-BC7E-00C04FD430AF}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2808	1128	regsvr32.exe	82
PID 1128 wrote to memory of 2808	1128	regsvr32.exe	82
PID 1128 wrote to memory of 2808	1128	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\13992ee845148fadf7afa52574dd382461d5a9030e07061b952fcefcd85072de.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\13992ee845148fadf7afa52574dd382461d5a9030e07061b952fcefcd85072de.dll
  2⤵
  - Modifies registry class
  PID:2808

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads