f891986630332757e0203805a75e0d83e863ae87f31f7a1adc6d1545498198d8

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
16/10/2022, 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ACCWIZ.dll
Size

162KB
MD5

7387dd7402c09340980dbac26899f8ab
SHA1

0cc7c5df1e3e35ccb6d02de602ecd8b7efcaad70
SHA256

ba43b61e2b6f64b7bf160cf37d87021ad92debed67d341dd6d217d382633e6eb
SHA512

e68af91c69c44403e76bcdae1fdeae14797227a97d84980863febed7c31542ffff223555cb7e31fb1bba99db179195c3157c217023c747a66891dc3db1a4144e
SSDEEP

1536:nFx47QZS2IdLeIHcO7QKfYyEEQ88NpYFDDBqdrj/rInvCtka03uiGJC:nJ6dVcIQiEEr8NWpqt/UkqBOC

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230327-172B-11D0-AD40-00A0C90DC8D9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230327-172B-11D0-AD40-00A0C90DC8D9}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230323-172B-11D0-AD40-00A0C90DC8D9}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230324-172B-11D0-AD40-00A0C90DC8D9}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230325-172B-11D0-AD40-00A0C90DC8D9}\ = "IFieldList"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230328-172B-11D0-AD40-00A0C90DC8D9}\TypeLib\ = "{5B87B6F0-17C8-11D0-AD41-00A0C90DC8D9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230322-172B-11D0-AD40-00A0C90DC8D9}\Version\ = "8.131473"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230322-172B-11D0-AD40-00A0C90DC8D9}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230327-172B-11D0-AD40-00A0C90DC8D9}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230327-172B-11D0-AD40-00A0C90DC8D9}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230321-172B-11D0-AD40-00A0C90DC8D9}\TypeLib\ = "{5B87B6F0-17C8-11D0-AD41-00A0C90DC8D9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230324-172B-11D0-AD40-00A0C90DC8D9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230325-172B-11D0-AD40-00A0C90DC8D9}\TypeLib\ = "{5B87B6F0-17C8-11D0-AD41-00A0C90DC8D9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230328-172B-11D0-AD40-00A0C90DC8D9}\ = "IFieldListWnd"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230322-172B-11D0-AD40-00A0C90DC8D9}\ = "ImexGridCtrl.1 Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ACCWIZ.FieldListCtrl.1\ = "FieldListCtrl.1 Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230320-172B-11D0-AD40-00A0C90DC8D9}\ = "IImexGrid"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230326-172B-11D0-AD40-00A0C90DC8D9}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ACCWIZ.FieldListCtrl.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ACCWIZ.FieldListCtrl.1.8\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230320-172B-11D0-AD40-00A0C90DC8D9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230326-172B-11D0-AD40-00A0C90DC8D9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230322-172B-11D0-AD40-00A0C90DC8D9}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230322-172B-11D0-AD40-00A0C90DC8D9}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ACCWIZ.FieldListCtrl.1.8\ = "FieldListCtrl.1 Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230323-172B-11D0-AD40-00A0C90DC8D9}\TypeLib\ = "{5B87B6F0-17C8-11D0-AD41-00A0C90DC8D9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230322-172B-11D0-AD40-00A0C90DC8D9}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ACCWIZ.FieldListCtrl.1\CurVer\ = "ACCWIZ.FieldListCtrl.1.8"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230327-172B-11D0-AD40-00A0C90DC8D9}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ACCWIZ.dll, 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ACCWIZ.FieldListCtrl.1.8\CLSID\ = "{53230327-172B-11D0-AD40-00A0C90DC8D9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230327-172B-11D0-AD40-00A0C90DC8D9}\ProgID\ = "ACCWIZ.FieldListCtrl.1.8"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{53230326-172B-11D0-AD40-00A0C90DC8D9}\TypeLib\Version = "8.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230326-172B-11D0-AD40-00A0C90DC8D9}\ = "DFieldListEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ACCWIZ.ImexGridCtrl.1\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230322-172B-11D0-AD40-00A0C90DC8D9}\VersionIndependentProgID\ = "ACCWIZ.ImexGridCtrl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230322-172B-11D0-AD40-00A0C90DC8D9}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230322-172B-11D0-AD40-00A0C90DC8D9}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230325-172B-11D0-AD40-00A0C90DC8D9}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ACCWIZ.ImexGridCtrl.1\ = "ImexGridCtrl.1 Object"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230327-172B-11D0-AD40-00A0C90DC8D9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230327-172B-11D0-AD40-00A0C90DC8D9}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230327-172B-11D0-AD40-00A0C90DC8D9}\MiscStatus\1\ = "131473"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B87B6F0-17C8-11D0-AD41-00A0C90DC8D9}\8.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{53230326-172B-11D0-AD40-00A0C90DC8D9}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230329-172B-11D0-AD40-00A0C90DC8D9}\TypeLib\Version = "8.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230322-172B-11D0-AD40-00A0C90DC8D9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ACCWIZ.ImexGridCtrl.1.8\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230323-172B-11D0-AD40-00A0C90DC8D9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230324-172B-11D0-AD40-00A0C90DC8D9}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{53230329-172B-11D0-AD40-00A0C90DC8D9}\TypeLib\Version = "8.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ACCWIZ.FieldListCtrl.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230326-172B-11D0-AD40-00A0C90DC8D9}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ACCWIZ.ImexGridCtrl.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230322-172B-11D0-AD40-00A0C90DC8D9}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230321-172B-11D0-AD40-00A0C90DC8D9}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230328-172B-11D0-AD40-00A0C90DC8D9}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230329-172B-11D0-AD40-00A0C90DC8D9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230329-172B-11D0-AD40-00A0C90DC8D9}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{53230327-172B-11D0-AD40-00A0C90DC8D9}\VersionIndependentProgID\ = "ACCWIZ.FieldListCtrl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230320-172B-11D0-AD40-00A0C90DC8D9}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{53230321-172B-11D0-AD40-00A0C90DC8D9}\TypeLib\Version = "8.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230326-172B-11D0-AD40-00A0C90DC8D9}\TypeLib\Version = "8.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230328-172B-11D0-AD40-00A0C90DC8D9}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53230329-172B-11D0-AD40-00A0C90DC8D9}\TypeLib\ = "{5B87B6F0-17C8-11D0-AD41-00A0C90DC8D9}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 944	1196	regsvr32.exe	27
PID 1196 wrote to memory of 944	1196	regsvr32.exe	27
PID 1196 wrote to memory of 944	1196	regsvr32.exe	27
PID 1196 wrote to memory of 944	1196	regsvr32.exe	27
PID 1196 wrote to memory of 944	1196	regsvr32.exe	27
PID 1196 wrote to memory of 944	1196	regsvr32.exe	27
PID 1196 wrote to memory of 944	1196	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ACCWIZ.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ACCWIZ.dll
  2⤵
  - Modifies registry class
  PID:944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-56-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1196-54-0x000007FEFB641000-0x000007FEFB643000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads