eb2544f1996d6687c5f94f6a74fe0c27279a2d5ffad99e76d7d0e24c290b81be

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JOCX.dll
Size

112KB
MD5

1fa4eb570ba1d755c00579454b4ac255
SHA1

b93223485c2a8a81cb2bca4e492ecf7d1b4621cf
SHA256

377b3986968f49cce17a657b0d05d8be04be5385a8d1e4f1c28f8cc784a472ae
SHA512

62b2ee916ccba541d438a3134f1204b875ee9556f267e1d19ee617b84f91251bfd780ca21f1dc877d8ad72a95855ecd9c6b60626dec56ececf89d3ef210e6f7d
SSDEEP

3072:vg6hatjiR33RZYSZHQFvQVlcYYYzrYYY+XpzYYYPYIY9YfY4f8yypZ+RyV:v7A8xnVQZiT+RyV

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D169265E-FC80-48AB-A86F-CD896E0625D4}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8F809A3A-76B5-4EA2-94E1-C4F2C227AE82}\ = "_DJOCXEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8F809A3A-76B5-4EA2-94E1-C4F2C227AE82}\TypeLib\ = "{72415B07-9B0C-4ED5-866F-B2B9F03B4272}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JOCX.JOCXCtrl.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{72415B07-9B0C-4ED5-866F-B2B9F03B4272}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D169265E-FC80-48AB-A86F-CD896E0625D4}\ = "_DJOCX"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JOCX.JOCXCtrl.1\ = "JOCX Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D169265E-FC80-48AB-A86F-CD896E0625D4}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8F809A3A-76B5-4EA2-94E1-C4F2C227AE82}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D169265E-FC80-48AB-A86F-CD896E0625D4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8F809A3A-76B5-4EA2-94E1-C4F2C227AE82}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35F410A5-0C2E-4328-B857-7D02CAEDEF9A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JOCX.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\ProgID\ = "JOCX.JOCXCtrl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{72415B07-9B0C-4ED5-866F-B2B9F03B4272}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8F809A3A-76B5-4EA2-94E1-C4F2C227AE82}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JOCX.JOCXCtrl.1\CLSID\ = "{324B327C-7F59-4E9A-B07D-27299D19EA71}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\Control\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{72415B07-9B0C-4ED5-866F-B2B9F03B4272}\1.0\FLAGS\ = "2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8F809A3A-76B5-4EA2-94E1-C4F2C227AE82}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{72415B07-9B0C-4ED5-866F-B2B9F03B4272}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D169265E-FC80-48AB-A86F-CD896E0625D4}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D169265E-FC80-48AB-A86F-CD896E0625D4}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D169265E-FC80-48AB-A86F-CD896E0625D4}\ = "_DJOCX"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D169265E-FC80-48AB-A86F-CD896E0625D4}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{72415B07-9B0C-4ED5-866F-B2B9F03B4272}\1.0\ = "JOCX ActiveX Control module"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{72415B07-9B0C-4ED5-866F-B2B9F03B4272}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8F809A3A-76B5-4EA2-94E1-C4F2C227AE82}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JOCX.JOCXCtrl.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D169265E-FC80-48AB-A86F-CD896E0625D4}\TypeLib\ = "{72415B07-9B0C-4ED5-866F-B2B9F03B4272}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8F809A3A-76B5-4EA2-94E1-C4F2C227AE82}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{72415B07-9B0C-4ED5-866F-B2B9F03B4272}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8F809A3A-76B5-4EA2-94E1-C4F2C227AE82}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35F410A5-0C2E-4328-B857-7D02CAEDEF9A}\ = "JOCX Property Page"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JOCX.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JOCX.dll, 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\TypeLib\ = "{72415B07-9B0C-4ED5-866F-B2B9F03B4272}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D169265E-FC80-48AB-A86F-CD896E0625D4}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8F809A3A-76B5-4EA2-94E1-C4F2C227AE82}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8F809A3A-76B5-4EA2-94E1-C4F2C227AE82}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D169265E-FC80-48AB-A86F-CD896E0625D4}\TypeLib\ = "{72415B07-9B0C-4ED5-866F-B2B9F03B4272}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8F809A3A-76B5-4EA2-94E1-C4F2C227AE82}\TypeLib\ = "{72415B07-9B0C-4ED5-866F-B2B9F03B4272}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8F809A3A-76B5-4EA2-94E1-C4F2C227AE82}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35F410A5-0C2E-4328-B857-7D02CAEDEF9A}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{72415B07-9B0C-4ED5-866F-B2B9F03B4272}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8F809A3A-76B5-4EA2-94E1-C4F2C227AE82}\ = "_DJOCXEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\ = "JOCX Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{324B327C-7F59-4E9A-B07D-27299D19EA71}\MiscStatus\1\ = "131473"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1576	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1576	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1576	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1576	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1576	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1576	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1576	1752	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JOCX.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\JOCX.dll
  2⤵
  - Modifies registry class
  PID:1576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1576-56-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1576-57-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/1752-54-0x000007FEFB7F1000-0x000007FEFB7F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads