c971a1d5e15888d3a317b5cfa388f39d3fd1d39940ca191764ab23d49a1142ea

Analysis

max time kernel
158s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c971a1d5e15888d3a317b5cfa388f39d3fd1d39940ca191764ab23d49a1142ea.dll
Size

236KB
MD5

78d3337f5ba951bb93eafc0bf4ea0c88
SHA1

7703c2d33388986b6211ab280e2d528cfab0b31b
SHA256

c971a1d5e15888d3a317b5cfa388f39d3fd1d39940ca191764ab23d49a1142ea
SHA512

f190b0e2869dee140d6a4af30a9c9d4d0fe2b7be4c8feeee87e50b8116bcc20e5c903ce1dd6d9753610bd2ee9dd3e5c4e147a1981844d9dd531d3fa19696df5c
SSDEEP

6144:oD+SRs3g/JqMdgtf+/wwPxAS7T2+QPYxZ:MSwJ/wqwwpAaT2LPYxZ

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DA596B51-D391-4387-82CA-27B76E904AA7}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E306E56-1030-4BDC-B099-CDE5676CC21D}\NumMethods\ = "8"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A834B41-95C2-49FC-8230-FE0215EB27B6}\NumMethods\ = "5"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2820A5E9-566D-4EA8-881C-B0DA89BCBDE8}\ = "IUnlock"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D952F7F3-936E-4C23-9A80-14C0EC1BFD5A}\ProxyStubClsid32\ = "{85E8A802-0A46-46A9-AE70-41AC2A01FED2}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0B8D5ACB-67CB-48B8-B096-523D087E358E}\ = "IVoiceActions"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BC552ADD-F93C-48F2-8D82-B946A4BE1883}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AFDE3A06-2121-4810-8AA6-C8581076866C}\NumMethods\ = "7"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B9BE082D-87E7-44D4-BF7F-1E47C667B79D}\ = "IMe"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B9BE082D-87E7-44D4-BF7F-1E47C667B79D}\NumMethods\ = "13"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{516A33A3-29B7-4BCE-8746-3FAE6CF109AF}\ProxyStubClsid32\ = "{85E8A802-0A46-46A9-AE70-41AC2A01FED2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F515ABA6-6699-46C8-9ECF-F40081AEEC37}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CA4ACC27-05A6-4BAB-9CCA-18F9A0C9576D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19E56371-02E7-4B5D-8AAD-9C612EC4C94F}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD05319E-BF6C-40EA-81D2-583D41DC53BE}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CA4ACC27-05A6-4BAB-9CCA-18F9A0C9576D}\ = "IError"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0ADDD3C1-951E-4D0E-A7B1-FD05EDF21645}\ProxyStubClsid32\ = "{85E8A802-0A46-46A9-AE70-41AC2A01FED2}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4075972B-F7F5-4702-80D2-432595125E0C}\ProxyStubClsid32\ = "{85E8A802-0A46-46A9-AE70-41AC2A01FED2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E306E56-1030-4BDC-B099-CDE5676CC21D}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4789172A-E8B6-4586-B17F-5076C883C96A}\NumMethods\ = "13"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E3B9B1AF-50F7-4F63-A07D-D3957243A58B}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{384715B3-76CD-43F3-8A1D-C9F5BE2E7ED3}\ProxyStubClsid32\ = "{85E8A802-0A46-46A9-AE70-41AC2A01FED2}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A419EC0-6F34-43DE-BE7C-D2A3BAE178B4}\ = "IFriend2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F14AEF61-C7BD-43AF-A0C5-284B79894A16}\ = "IHTMLFriendIconsCallback"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C29BA27C-8018-4261-833C-C87367DFECC4}\ = "ISecondaryWindow"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39B6337B-240F-4F37-B7A8-753E4DBCEAFF}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0012B49A-47A4-451C-ADB6-38AA713626C2}\ProxyStubClsid32\ = "{85E8A802-0A46-46A9-AE70-41AC2A01FED2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0012B49A-47A4-451C-ADB6-38AA713626C2}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CCAD6A47-5701-4018-B1A5-654672FDC4B6}\NumMethods\ = "8"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ECC36F57-007E-4F4A-A105-73B22382F448}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D03D06C-D620-47EC-9D77-E6B07CF0FD64}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFC608C0-A980-40AC-834E-3D7B28E0C312}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3291FAC8-42D8-4849-990E-A78F2329ED88}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B22C40E2-637E-439D-A393-10F03C088CD6}\ProxyStubClsid32\ = "{85E8A802-0A46-46A9-AE70-41AC2A01FED2}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{889072C5-3CE0-4F39-A9F2-B9A0E62E2873}\ = "IObjectSetup"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0ADDD3C1-951E-4D0E-A7B1-FD05EDF21645}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5851F64D-D541-4227-9B90-5850CD6F163B}\NumMethods\ = "8"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C29BA27C-8018-4261-833C-C87367DFECC4}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAA91186-F2A7-4E69-908A-AEF3C18245AB}\NumMethods\ = "13"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B6ED8C4-5B91-11D5-803C-00D0B768B4B0}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3F558CD5-7057-4120-8C09-582F5D4FE6CD}\ = "IContactListUI"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8351ADE-030E-4099-B6BB-462AF56B7438}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD05319E-BF6C-40EA-81D2-583D41DC53BE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8223133-8E8B-4C49-A793-44BF793E1021}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5851F64D-D541-4227-9B90-5850CD6F163B}\ProxyStubClsid32\ = "{85E8A802-0A46-46A9-AE70-41AC2A01FED2}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C29BA27C-8018-4261-833C-C87367DFECC4}\NumMethods\ = "9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{299C83F6-86E3-4ECF-BC2F-B3E8EDF54157}\ = "IHTMLSSAViewerCallback"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48CB70A3-8851-4467-BB70-202D89056828}\ = "IAuthorize"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9931BD6-E19C-4C22-9390-1A83B3773C1E}\NumMethods\ = "9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7D4187F-CDC3-44DB-8E3F-17E8041E52B1}\ProxyStubClsid32\ = "{85E8A802-0A46-46A9-AE70-41AC2A01FED2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E5D12C4D-7B4F-11D3-B5C9-0050045C3C96}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F14AEF61-C7BD-43AF-A0C5-284B79894A16}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6DE5268-66D3-4E61-8051-6B6AF86F43F2}\ProxyStubClsid32\ = "{85E8A802-0A46-46A9-AE70-41AC2A01FED2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19E56371-02E7-4B5D-8AAD-9C612EC4C94F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E3B9B1AF-50F7-4F63-A07D-D3957243A58B}\ = "IAddressBook"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3291FAC8-42D8-4849-990E-A78F2329ED88}\NumMethods\ = "9"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0B8D5ACB-67CB-48B8-B096-523D087E358E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8351ADE-030E-4099-B6BB-462AF56B7438}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E5D12C4D-7B4F-11D3-B5C9-0050045C3C96}\ = "IMessenger"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C29BA27C-8018-4261-833C-C87367DFECC4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0012B49A-47A4-451C-ADB6-38AA713626C2}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3291FAC8-42D8-4849-990E-A78F2329ED88}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7FDAD62C-6E9C-4206-9EED-04A2219E603A}\ = "IHTMLGamesTabCallback"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7D4187F-CDC3-44DB-8E3F-17E8041E52B1}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 480 wrote to memory of 4240	480	regsvr32.exe	83
PID 480 wrote to memory of 4240	480	regsvr32.exe	83
PID 480 wrote to memory of 4240	480	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c971a1d5e15888d3a317b5cfa388f39d3fd1d39940ca191764ab23d49a1142ea.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:480
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c971a1d5e15888d3a317b5cfa388f39d3fd1d39940ca191764ab23d49a1142ea.dll
  2⤵
  - Modifies registry class
  PID:4240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4240-132-0x0000000000000000-mapping.dmp

Download
memory/4240-133-0x0000000061260000-0x000000006129B000-memory.dmp

Filesize
236KB

Download
memory/4240-134-0x00000000025E0000-0x00000000025E5000-memory.dmp

Filesize
20KB

Download
memory/4240-135-0x00000000025B0000-0x00000000025D5000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads