Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 21:32
Static task
static1
Behavioral task
behavioral1
Sample
13b91296f8e66657c55c50e0803d70408099c99a425c2a89563744c4b974fce7.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
13b91296f8e66657c55c50e0803d70408099c99a425c2a89563744c4b974fce7.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
13b91296f8e66657c55c50e0803d70408099c99a425c2a89563744c4b974fce7.dll
-
Size
809KB
-
MD5
0e2d85b348b2957ee9dd017b303d6e30
-
SHA1
d7bdb0c828e9461cdee9f6601845d850f398574b
-
SHA256
13b91296f8e66657c55c50e0803d70408099c99a425c2a89563744c4b974fce7
-
SHA512
53fb91954837134a5c34936083d934c9a8f408d9c674e90259f9abddc0357ff4fcb4c4ce39d5e7caca402d61bc75b64c7d567625ab772cf71281668871e0ea9f
-
SSDEEP
24576:bFSMOOkC7sCVgDy93/NjdISJzWCHRotGNN:bQjY7d1/NWSJyysGNN
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Version Vector\VML = "1.0" regsvr32.exe -
Modifies registry class 27 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PeerDraw.PeerDraw.1\ = "PeerDraw Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\ProgID\ = "PeerDraw.PeerDraw.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\ = "PeerDraw Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\VersionIndependentProgID\ = "PeerDraw.PeerDraw" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PeerDraw.PeerDraw\ = "PeerDraw Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PeerDraw.PeerDraw\CurVer\ = "PeerDraw.PeerDraw.1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PeerDraw.PeerDraw.1\CLSID\ = "{10072CEC-8CC1-11D1-986E-00A0C955B42E}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13b91296f8e66657c55c50e0803d70408099c99a425c2a89563744c4b974fce7.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\ProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\Component Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\Implemented Categories regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10072CEC-8CC1-11D1-986E-00A0C955B42E}\InprocServer32 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1896 wrote to memory of 2016 1896 regsvr32.exe 27 PID 1896 wrote to memory of 2016 1896 regsvr32.exe 27 PID 1896 wrote to memory of 2016 1896 regsvr32.exe 27 PID 1896 wrote to memory of 2016 1896 regsvr32.exe 27 PID 1896 wrote to memory of 2016 1896 regsvr32.exe 27 PID 1896 wrote to memory of 2016 1896 regsvr32.exe 27 PID 1896 wrote to memory of 2016 1896 regsvr32.exe 27
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\13b91296f8e66657c55c50e0803d70408099c99a425c2a89563744c4b974fce7.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\13b91296f8e66657c55c50e0803d70408099c99a425c2a89563744c4b974fce7.dll2⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2016
-