f8693beb853a9381c671343555d022227b1f4fc512ce4d27c740847ccbe1dda2

Analysis

max time kernel
36s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 21:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f8693beb853a9381c671343555d022227b1f4fc512ce4d27c740847ccbe1dda2.dll
Size

1.5MB
MD5

4aa319aaa8037b3193a71ec94e0c399f
SHA1

797b1504784e61dfd8863d3bd98aa6974b1a31da
SHA256

f8693beb853a9381c671343555d022227b1f4fc512ce4d27c740847ccbe1dda2
SHA512

10a06d92daf898ce7ca9ec3a9c4e1c89614ed4bedc0906bcb86245450e43e7f6a23a3e81daaaf15117e450c1e41fd695f08cc85676f7e2ba8b561866c0502398
SSDEEP

24576:3nKGDJ6q3aVWqHoTwOhskGGV8ejpkn4wyHxFOaukw7UmG3m9lr1qiui5bicg0zLu:WHoThjV8eGnObRfmBv1yi5C0PFgBe

Score

1^/10

Malware Config

Signatures

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3EE34392-6127-4CC7-A514-3AF30F30803D}\ = "_Set"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3EE34392-6127-4CC7-A514-3AF30F30803D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EE34392-6127-4CC7-A514-3AF30F30803D}\ = "_Set"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EE34392-6127-4CC7-A514-3AF30F30803D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EE34392-6127-4CC7-A514-3AF30F30803D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62155E80-6B93-4F99-BE83-FD6FB8266297}\ = "rEOAxF.Set"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62155E80-6B93-4F99-BE83-FD6FB8266297}\ProgID\ = "rEOAxF.Set"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{C3922E6E-4A83-4AB9-9D6C-95A008BFD20F}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rEOAxF.Set\ = "rEOAxF.Set"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62155E80-6B93-4F99-BE83-FD6FB8266297}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EE34392-6127-4CC7-A514-3AF30F30803D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62155E80-6B93-4F99-BE83-FD6FB8266297}\VERSION\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rEOAxF.Set\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rEOAxF.Set\Clsid\ = "{62155E80-6B93-4F99-BE83-FD6FB8266297}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{C3922E6E-4A83-4AB9-9D6C-95A008BFD20F}\1.0\ = "rEOAxF"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3EE34392-6127-4CC7-A514-3AF30F30803D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62155E80-6B93-4F99-BE83-FD6FB8266297}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62155E80-6B93-4F99-BE83-FD6FB8266297}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62155E80-6B93-4F99-BE83-FD6FB8266297}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3EE34392-6127-4CC7-A514-3AF30F30803D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{C3922E6E-4A83-4AB9-9D6C-95A008BFD20F}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{C3922E6E-4A83-4AB9-9D6C-95A008BFD20F}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f8693beb853a9381c671343555d022227b1f4fc512ce4d27c740847ccbe1dda2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3EE34392-6127-4CC7-A514-3AF30F30803D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EE34392-6127-4CC7-A514-3AF30F30803D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EE34392-6127-4CC7-A514-3AF30F30803D}\TypeLib\ = "{C3922E6E-4A83-4AB9-9D6C-95A008BFD20F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62155E80-6B93-4F99-BE83-FD6FB8266297}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62155E80-6B93-4F99-BE83-FD6FB8266297}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f8693beb853a9381c671343555d022227b1f4fc512ce4d27c740847ccbe1dda2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{C3922E6E-4A83-4AB9-9D6C-95A008BFD20F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62155E80-6B93-4F99-BE83-FD6FB8266297}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3EE34392-6127-4CC7-A514-3AF30F30803D}\ = "Set"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62155E80-6B93-4F99-BE83-FD6FB8266297}\TypeLib\ = "{C3922E6E-4A83-4AB9-9D6C-95A008BFD20F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3EE34392-6127-4CC7-A514-3AF30F30803D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EE34392-6127-4CC7-A514-3AF30F30803D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{C3922E6E-4A83-4AB9-9D6C-95A008BFD20F}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{C3922E6E-4A83-4AB9-9D6C-95A008BFD20F}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{C3922E6E-4A83-4AB9-9D6C-95A008BFD20F}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3EE34392-6127-4CC7-A514-3AF30F30803D}\TypeLib\ = "{C3922E6E-4A83-4AB9-9D6C-95A008BFD20F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62155E80-6B93-4F99-BE83-FD6FB8266297}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rEOAxF.Set	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{C3922E6E-4A83-4AB9-9D6C-95A008BFD20F}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62155E80-6B93-4F99-BE83-FD6FB8266297}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3EE34392-6127-4CC7-A514-3AF30F30803D}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3EE34392-6127-4CC7-A514-3AF30F30803D}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62155E80-6B93-4F99-BE83-FD6FB8266297}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{C3922E6E-4A83-4AB9-9D6C-95A008BFD20F}\1.0\FLAGS	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2000	1220	regsvr32.exe	26
PID 1220 wrote to memory of 2000	1220	regsvr32.exe	26
PID 1220 wrote to memory of 2000	1220	regsvr32.exe	26
PID 1220 wrote to memory of 2000	1220	regsvr32.exe	26
PID 1220 wrote to memory of 2000	1220	regsvr32.exe	26
PID 1220 wrote to memory of 2000	1220	regsvr32.exe	26
PID 1220 wrote to memory of 2000	1220	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f8693beb853a9381c671343555d022227b1f4fc512ce4d27c740847ccbe1dda2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f8693beb853a9381c671343555d022227b1f4fc512ce4d27c740847ccbe1dda2.dll
  2⤵
  - Modifies registry class
  PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-54-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

Filesize
8KB

Download
memory/2000-56-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/2000-57-0x0000000011000000-0x00000000120E8000-memory.dmp

Filesize
16.9MB

Download
memory/2000-58-0x0000000000330000-0x00000000003B0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads