Analysis
-
max time kernel
96s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 06:22
Static task
static1
Behavioral task
behavioral1
Sample
581aa5b2bf9d93858e92fa0467929e2b83026fb3d685f770340d5105dd6ac92e.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
581aa5b2bf9d93858e92fa0467929e2b83026fb3d685f770340d5105dd6ac92e.dll
Resource
win10v2004-20220812-en
General
-
Target
581aa5b2bf9d93858e92fa0467929e2b83026fb3d685f770340d5105dd6ac92e.dll
-
Size
211KB
-
MD5
8eded797ec79b7372ad87de2eae8fc07
-
SHA1
8687d3cc7748a841b468e19a0a6a254589e7fb0c
-
SHA256
581aa5b2bf9d93858e92fa0467929e2b83026fb3d685f770340d5105dd6ac92e
-
SHA512
99f770e4ae0670e60d854dce510d854c42235520313a812165f4feb4cc381a593f5b7e16c2fd49e25b352228cb6378fb4384d8e9c35ac591227560c78168da8d
-
SSDEEP
3072:iOC16nBcBz4Lv0cTixNTcjvQeUsktDO1fb5cVCDp85Po5rG6cU2YIL9bR3:bC1eAc0DsuDO1fb5cVC3159y
Malware Config
Signatures
-
Modifies registry class 64 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5638D7EE-97CA-4DD3-B993-26E89FBE6CA1}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HPCUE.LogEntry regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6BA8A6EA-6038-4613-A4AC-8FDF27CCD481}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89BB0AB5-01E5-412C-9205-0769D23A35F2}\TypeLib\ = "{6BA8A6EA-6038-4613-A4AC-8FDF27CCD481}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{82047FCB-4B9E-458D-B315-CB9F6F0A095A}\TypeLib\ = "{6BA8A6EA-6038-4613-A4AC-8FDF27CCD481}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB72C778-DC69-404C-BAFA-D0B475C128D3}\ = "_DIHPCUEEventLogEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5638D7EE-97CA-4DD3-B993-26E89FBE6CA1}\ProgID\ = "HPCUE.TrayAppCtxList.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6DEDDA4-5DC9-48A8-83F8-66A4D932AF0F}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HPCUE.EventLog regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HPCUE.EventLog\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32E11268-1FBF-43ED-B75A-3F9420415D18}\ = "HPCUEEventLog Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{82047FCB-4B9E-458D-B315-CB9F6F0A095A}\ = "DIHPCUEEventLog" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{82047FCB-4B9E-458D-B315-CB9F6F0A095A}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EB72C778-DC69-404C-BAFA-D0B475C128D3}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HPCUE.TrayAppCtx\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6DEDDA4-5DC9-48A8-83F8-66A4D932AF0F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32E11268-1FBF-43ED-B75A-3F9420415D18}\ProgID\ = "HPCUE.EventLog.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32E11268-1FBF-43ED-B75A-3F9420415D18}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89BB0AB5-01E5-412C-9205-0769D23A35F2}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{89BB0AB5-01E5-412C-9205-0769D23A35F2}\TypeLib\ = "{6BA8A6EA-6038-4613-A4AC-8FDF27CCD481}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{82047FCB-4B9E-458D-B315-CB9F6F0A095A}\TypeLib\ = "{6BA8A6EA-6038-4613-A4AC-8FDF27CCD481}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02EC5D65-1494-4BA3-AE40-8B6CD8CB8B7F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EB72C778-DC69-404C-BAFA-D0B475C128D3}\ = "_DIHPCUEEventLogEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB72C778-DC69-404C-BAFA-D0B475C128D3}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6DEDDA4-5DC9-48A8-83F8-66A4D932AF0F}\VersionIndependentProgID\ = "HPCUE.TrayAppCtx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6DEDDA4-5DC9-48A8-83F8-66A4D932AF0F}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26A870E8-5C86-465C-BF6F-0EA63F6F0CDB}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{89BB0AB5-01E5-412C-9205-0769D23A35F2} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D5AB8C5E-D4CE-4E5E-A3B3-7D6AE5F42686}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D5AB8C5E-D4CE-4E5E-A3B3-7D6AE5F42686}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D5AB8C5E-D4CE-4E5E-A3B3-7D6AE5F42686}\TypeLib\ = "{6BA8A6EA-6038-4613-A4AC-8FDF27CCD481}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{82047FCB-4B9E-458D-B315-CB9F6F0A095A}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{02EC5D65-1494-4BA3-AE40-8B6CD8CB8B7F}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HPCUE.TrayAppCtxList.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HPCUE.TrayAppCtx.1\ = "HPCUETrayAppCtx Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26A870E8-5C86-465C-BF6F-0EA63F6F0CDB}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6BA8A6EA-6038-4613-A4AC-8FDF27CCD481}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89BB0AB5-01E5-412C-9205-0769D23A35F2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D5AB8C5E-D4CE-4E5E-A3B3-7D6AE5F42686}\ = "_DIHPCUETAPlugInEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26A870E8-5C86-465C-BF6F-0EA63F6F0CDB}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{82047FCB-4B9E-458D-B315-CB9F6F0A095A}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB72C778-DC69-404C-BAFA-D0B475C128D3}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HPCUE.TrayAppCtxList.1\ = "HPCUETrayAppCtxList Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HPCUE.EventLog\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89BB0AB5-01E5-412C-9205-0769D23A35F2}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D5AB8C5E-D4CE-4E5E-A3B3-7D6AE5F42686}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB72C778-DC69-404C-BAFA-D0B475C128D3}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E49586-EF5C-4BDA-B7A2-48322682DE43}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{82047FCB-4B9E-458D-B315-CB9F6F0A095A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5638D7EE-97CA-4DD3-B993-26E89FBE6CA1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\581aa5b2bf9d93858e92fa0467929e2b83026fb3d685f770340d5105dd6ac92e.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HPCUE.TrayAppCtx.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HPCUE.EventLog\CLSID\ = "{32E11268-1FBF-43ED-B75A-3F9420415D18}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26A870E8-5C86-465C-BF6F-0EA63F6F0CDB}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\581aa5b2bf9d93858e92fa0467929e2b83026fb3d685f770340d5105dd6ac92e.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89BB0AB5-01E5-412C-9205-0769D23A35F2}\ = "DIHPCUETrayAppCtxList" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{89BB0AB5-01E5-412C-9205-0769D23A35F2}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02EC5D65-1494-4BA3-AE40-8B6CD8CB8B7F}\TypeLib\ = "{6BA8A6EA-6038-4613-A4AC-8FDF27CCD481}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5638D7EE-97CA-4DD3-B993-26E89FBE6CA1}\ = "HPCUETrayAppCtxList Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HPCUE.LogEntry\CLSID\ = "{26A870E8-5C86-465C-BF6F-0EA63F6F0CDB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB72C778-DC69-404C-BAFA-D0B475C128D3} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E49586-EF5C-4BDA-B7A2-48322682DE43}\TypeLib\ = "{6BA8A6EA-6038-4613-A4AC-8FDF27CCD481}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HPCUE.TrayAppCtxList regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HPCUE.TrayAppCtxList\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6DEDDA4-5DC9-48A8-83F8-66A4D932AF0F}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6BA8A6EA-6038-4613-A4AC-8FDF27CCD481}\1.0 regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 4904 wrote to memory of 4824 4904 regsvr32.exe regsvr32.exe PID 4904 wrote to memory of 4824 4904 regsvr32.exe regsvr32.exe PID 4904 wrote to memory of 4824 4904 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\581aa5b2bf9d93858e92fa0467929e2b83026fb3d685f770340d5105dd6ac92e.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\581aa5b2bf9d93858e92fa0467929e2b83026fb3d685f770340d5105dd6ac92e.dll2⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4824-132-0x0000000000000000-mapping.dmp
-
memory/4824-133-0x0000000015800000-0x0000000015838000-memory.dmpFilesize
224KB
-
memory/4824-134-0x00000000009B0000-0x00000000009BF000-memory.dmpFilesize
60KB
-
memory/4824-135-0x0000000015800000-0x0000000015838000-memory.dmpFilesize
224KB
-
memory/4824-136-0x00000000009C0000-0x00000000009CF000-memory.dmpFilesize
60KB