8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303

General

Target

8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll
Size

360KB
MD5

009a377f960e8986f17eb313c7e30d3b
SHA1

8a91baad1f7159f15dd70a3f41c30c2e2d70ae50
SHA256

8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303
SHA512

21d41a141da2501feebd2fe90692f8362a8b27a0d4b1664447e5f6858ca61d46a52cbb61bb97b8e89b93e9d074ed8253e595b4bd6a723d2aa2862ba7d65f33ff
SSDEEP

6144:WgLHUgZfOnsD/Z7NZejt4Pp4pJlrInQuIgVH4dLwvZ2D7O0X+a:WJ1i/Z7n+lzuIgeQ2DC0X+a

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4270F4E2-D71D-43C0-B87E-16CD4C473CF2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA507A52-AA4D-4BAA-8215-27951153A676}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AE010487-B795-4876-959A-0B983CD55B78}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49F77FDE-F983-454B-BD05-EBC28CA8E232}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9112F8B6-CB89-438D-994F-37D6ACAD15E5}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4270F4E2-D71D-43C0-B87E-16CD4C473CF2}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9112F8B6-CB89-438D-994F-37D6ACAD15E5}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9112F8B6-CB89-438D-994F-37D6ACAD15E5}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{930FC521-1AEE-4AE3-8E63-7CEA043D5DDC}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BFE4153-B5F7-47D7-8F85-5BE0F842171F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE0AE08F-6166-45C6-AC42-32A27E033227}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA507A52-AA4D-4BAA-8215-27951153A676}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA507A52-AA4D-4BAA-8215-27951153A676}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA507A52-AA4D-4BAA-8215-27951153A676}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8981EB1-2EF8-4201-923B-6E632FAEAF9A}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4270F4E2-D71D-43C0-B87E-16CD4C473CF2}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE0AE08F-6166-45C6-AC42-32A27E033227}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA507A52-AA4D-4BAA-8215-27951153A676}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F356866B-13E9-43B1-8C32-5C794B5E08DC}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{930FC521-1AEE-4AE3-8E63-7CEA043D5DDC}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4270F4E2-D71D-43C0-B87E-16CD4C473CF2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BFE4153-B5F7-47D7-8F85-5BE0F842171F}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F356866B-13E9-43B1-8C32-5C794B5E08DC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F356866B-13E9-43B1-8C32-5C794B5E08DC}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{930FC521-1AEE-4AE3-8E63-7CEA043D5DDC}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C5484E0B-E072-4454-8A4E-572BED294211}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA507A52-AA4D-4BAA-8215-27951153A676}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AE010487-B795-4876-959A-0B983CD55B78}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{930FC521-1AEE-4AE3-8E63-7CEA043D5DDC}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{930FC521-1AEE-4AE3-8E63-7CEA043D5DDC}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BFE4153-B5F7-47D7-8F85-5BE0F842171F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C5484E0B-E072-4454-8A4E-572BED294211}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE0AE08F-6166-45C6-AC42-32A27E033227}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE0AE08F-6166-45C6-AC42-32A27E033227}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9112F8B6-CB89-438D-994F-37D6ACAD15E5}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9112F8B6-CB89-438D-994F-37D6ACAD15E5}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F356866B-13E9-43B1-8C32-5C794B5E08DC}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4270F4E2-D71D-43C0-B87E-16CD4C473CF2}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8981EB1-2EF8-4201-923B-6E632FAEAF9A}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BFE4153-B5F7-47D7-8F85-5BE0F842171F}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE0AE08F-6166-45C6-AC42-32A27E033227}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49F77FDE-F983-454B-BD05-EBC28CA8E232}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F356866B-13E9-43B1-8C32-5C794B5E08DC}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AE010487-B795-4876-959A-0B983CD55B78}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BFE4153-B5F7-47D7-8F85-5BE0F842171F}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C5484E0B-E072-4454-8A4E-572BED294211}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C5484E0B-E072-4454-8A4E-572BED294211}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49F77FDE-F983-454B-BD05-EBC28CA8E232}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9112F8B6-CB89-438D-994F-37D6ACAD15E5}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8981EB1-2EF8-4201-923B-6E632FAEAF9A}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AE010487-B795-4876-959A-0B983CD55B78}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C5484E0B-E072-4454-8A4E-572BED294211}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE0AE08F-6166-45C6-AC42-32A27E033227}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9112F8B6-CB89-438D-994F-37D6ACAD15E5}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8981EB1-2EF8-4201-923B-6E632FAEAF9A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F356866B-13E9-43B1-8C32-5C794B5E08DC}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{930FC521-1AEE-4AE3-8E63-7CEA043D5DDC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C5484E0B-E072-4454-8A4E-572BED294211}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49F77FDE-F983-454B-BD05-EBC28CA8E232}\Implemented Categories\{9A7508B4-B717-444A-83A7-C13C80E5BB01}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA507A52-AA4D-4BAA-8215-27951153A676}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F356866B-13E9-43B1-8C32-5C794B5E08DC}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 232 wrote to memory of 2348	232	regsvr32.exe	regsvr32.exe
PID 232 wrote to memory of 2348	232	regsvr32.exe	regsvr32.exe
PID 232 wrote to memory of 2348	232	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:232

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\8062c328b65783c0183fcc1b04d1fcf7494b7db1f714c0ae271f9cdf45ac7303.dll
2⤵
- Modifies registry class
PID:2348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2348-132-0x0000000000000000-mapping.dmp

Download
memory/2348-133-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2348-134-0x0000000001310000-0x0000000001340000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads