8c512f39403d8773693ac5cc3abba3e7e673c3ac4df9316863dfd6a15683b5b5

Analysis

max time kernel
165s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c512f39403d8773693ac5cc3abba3e7e673c3ac4df9316863dfd6a15683b5b5.dll
Size

564KB
MD5

d7d392cd13524bf26306d30a86fbf700
SHA1

084b8235a78cded9978898727e0ffd980760425e
SHA256

8c512f39403d8773693ac5cc3abba3e7e673c3ac4df9316863dfd6a15683b5b5
SHA512

6359dab2f80d2253eb159de3a86682ad87c0bca813e8b8dbece157bdd5e82bb5c223b9afc1a6a3c201ee98a6640c34fe88ba31e4dbdd10b4b0356d6865eaed03
SSDEEP

6144:y5wZOFixtFi/zZjjXJly8Yr2KiYhh7fxkRfPTnlbL5cz:3OeUBy802KiYyRznlb2

Score

1^/10

Malware Config

Signatures

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78A709E-CECA-430D-BB52-34C0ECCDA6A5}\VERSION\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78A709E-CECA-430D-BB52-34C0ECCDA6A5}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF2CBCA4-A5E1-4D07-A8E5-094002A8A7BA}\TypeLib\ = "{1FEF4514-28E7-4AFA-83A1-5F7E4C8C0050}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF2CBCA4-A5E1-4D07-A8E5-094002A8A7BA}\ = "_ClsHouse"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78A709E-CECA-430D-BB52-34C0ECCDA6A5}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78A709E-CECA-430D-BB52-34C0ECCDA6A5}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\House.ClsHouse\Clsid\ = "{A78A709E-CECA-430D-BB52-34C0ECCDA6A5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF2CBCA4-A5E1-4D07-A8E5-094002A8A7BA}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1FEF4514-28E7-4AFA-83A1-5F7E4C8C0050}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF2CBCA4-A5E1-4D07-A8E5-094002A8A7BA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78A709E-CECA-430D-BB52-34C0ECCDA6A5}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\House.ClsHouse\ = "House.ClsHouse"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF2CBCA4-A5E1-4D07-A8E5-094002A8A7BA}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78A709E-CECA-430D-BB52-34C0ECCDA6A5}\TypeLib\ = "{1FEF4514-28E7-4AFA-83A1-5F7E4C8C0050}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1FEF4514-28E7-4AFA-83A1-5F7E4C8C0050}\1.0\ = "House"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1FEF4514-28E7-4AFA-83A1-5F7E4C8C0050}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1FEF4514-28E7-4AFA-83A1-5F7E4C8C0050}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF2CBCA4-A5E1-4D07-A8E5-094002A8A7BA}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\House.ClsHouse	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF2CBCA4-A5E1-4D07-A8E5-094002A8A7BA}\ = "ClsHouse"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78A709E-CECA-430D-BB52-34C0ECCDA6A5}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78A709E-CECA-430D-BB52-34C0ECCDA6A5}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1FEF4514-28E7-4AFA-83A1-5F7E4C8C0050}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF2CBCA4-A5E1-4D07-A8E5-094002A8A7BA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF2CBCA4-A5E1-4D07-A8E5-094002A8A7BA}\TypeLib\ = "{1FEF4514-28E7-4AFA-83A1-5F7E4C8C0050}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF2CBCA4-A5E1-4D07-A8E5-094002A8A7BA}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78A709E-CECA-430D-BB52-34C0ECCDA6A5}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78A709E-CECA-430D-BB52-34C0ECCDA6A5}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1FEF4514-28E7-4AFA-83A1-5F7E4C8C0050}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF2CBCA4-A5E1-4D07-A8E5-094002A8A7BA}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF2CBCA4-A5E1-4D07-A8E5-094002A8A7BA}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78A709E-CECA-430D-BB52-34C0ECCDA6A5}\ProgID\ = "House.ClsHouse"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1FEF4514-28E7-4AFA-83A1-5F7E4C8C0050}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1FEF4514-28E7-4AFA-83A1-5F7E4C8C0050}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78A709E-CECA-430D-BB52-34C0ECCDA6A5}\ = "House.ClsHouse"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78A709E-CECA-430D-BB52-34C0ECCDA6A5}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF2CBCA4-A5E1-4D07-A8E5-094002A8A7BA}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF2CBCA4-A5E1-4D07-A8E5-094002A8A7BA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A78A709E-CECA-430D-BB52-34C0ECCDA6A5}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8c512f39403d8773693ac5cc3abba3e7e673c3ac4df9316863dfd6a15683b5b5.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\House.ClsHouse\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF2CBCA4-A5E1-4D07-A8E5-094002A8A7BA}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1FEF4514-28E7-4AFA-83A1-5F7E4C8C0050}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1FEF4514-28E7-4AFA-83A1-5F7E4C8C0050}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8c512f39403d8773693ac5cc3abba3e7e673c3ac4df9316863dfd6a15683b5b5.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF2CBCA4-A5E1-4D07-A8E5-094002A8A7BA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF2CBCA4-A5E1-4D07-A8E5-094002A8A7BA}\ = "_ClsHouse"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 3628	992	regsvr32.exe	83
PID 992 wrote to memory of 3628	992	regsvr32.exe	83
PID 992 wrote to memory of 3628	992	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8c512f39403d8773693ac5cc3abba3e7e673c3ac4df9316863dfd6a15683b5b5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8c512f39403d8773693ac5cc3abba3e7e673c3ac4df9316863dfd6a15683b5b5.dll
  2⤵
  - Modifies registry class
  PID:3628

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads