abba00e181c1e18d7d624212f1ed2392ee3433c4d9f978c424010a3efe1fc98c

Analysis

max time kernel
167s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abba00e181c1e18d7d624212f1ed2392ee3433c4d9f978c424010a3efe1fc98c.dll
Size

15KB
MD5

a1fd879ee5c2c26c8d7a65c2380dc60a
SHA1

404fa0f774670dd0a9df1bcc81705a6e06b19a1e
SHA256

abba00e181c1e18d7d624212f1ed2392ee3433c4d9f978c424010a3efe1fc98c
SHA512

7cd7e2c3fce6827eeddce6fa7db701238347eb0e7342081f4b1caa3513e6ad43eebc89919d778fbd075c0033adccf5612106fac637bf3d070127e4240a3113b6
SSDEEP

384:MWy3ET/gNSUjwvpGwS10wthz4FZyIAR0JWQ2JIZ:sU/gNHwvpjM2LJWOZ

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F832C2B2-312D-11D2-8D5F-0000F87734F0}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F832C2B2-312D-11D2-8D5F-0000F87734F0}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.ISPData\ = "CLSID_ICWISPData"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.ISPData\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.ISPData.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B79EEAD-2728-11D2-8D58-0000F87734F0}\ = "CLSID_ICWWalker"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.Walker.1\ = "CLSID_ICWWalker"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.Walker.1\CLSID\ = "{3B79EEAD-2728-11D2-8D58-0000F87734F0}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.GifConvert	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.ISPData\CLSID\ = "{29548507-3886-11D2-8D63-0000F87734F0}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.WebView\CLSID\ = "{99BA617B-219E-11D2-AE1B-0000F87734F0}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.Walker\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99BA617B-219E-11D2-AE1B-0000F87734F0}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.WebView\ = "CLSID_ICWWebView"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B79EEAD-2728-11D2-8D58-0000F87734F0}\ProgID\ = "ICWCONN.Walker.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B79EEAD-2728-11D2-8D58-0000F87734F0}\VersionIndependentProgID\ = "ICWCONN.Walker"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.ISPData.1\CLSID\ = "{29548507-3886-11D2-8D63-0000F87734F0}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99BA617B-219E-11D2-AE1B-0000F87734F0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\abba00e181c1e18d7d624212f1ed2392ee3433c4d9f978c424010a3efe1fc98c.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.WebView\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.WebView.1\CLSID\ = "{99BA617B-219E-11D2-AE1B-0000F87734F0}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B79EEAD-2728-11D2-8D58-0000F87734F0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F832C2B2-312D-11D2-8D5F-0000F87734F0}\ = "CLSID_ICWGifConvert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F832C2B2-312D-11D2-8D5F-0000F87734F0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\abba00e181c1e18d7d624212f1ed2392ee3433c4d9f978c424010a3efe1fc98c.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{29548507-3886-11D2-8D63-0000F87734F0}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{29548507-3886-11D2-8D63-0000F87734F0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\abba00e181c1e18d7d624212f1ed2392ee3433c4d9f978c424010a3efe1fc98c.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99BA617B-219E-11D2-AE1B-0000F87734F0}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99BA617B-219E-11D2-AE1B-0000F87734F0}\ProgID\ = "ICWCONN.WebView.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.ISPData.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{29548507-3886-11D2-8D63-0000F87734F0}\VersionIndependentProgID\ = "ICWCONN.ISPData"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.ISPData	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.Walker\ = "CLSID_ICWWalker"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{29548507-3886-11D2-8D63-0000F87734F0}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.ISPData.1\ = "CLSID_ICWISPData"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B79EEAD-2728-11D2-8D58-0000F87734F0}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B79EEAD-2728-11D2-8D58-0000F87734F0}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.GifConvert.1\ = "CLSID_ICWGifConvert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99BA617B-219E-11D2-AE1B-0000F87734F0}\VersionIndependentProgID\ = "ICWCONN.WebView"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.GifConvert\CurVer\ = "ICWCONN.GifConvert.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.Walker\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.WebView\CurVer\ = "ICWCONN.WebView.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.Walker	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.WebView.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.Walker\CurVer\ = "ICWCONN.Walker.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F832C2B2-312D-11D2-8D5F-0000F87734F0}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{29548507-3886-11D2-8D63-0000F87734F0}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{29548507-3886-11D2-8D63-0000F87734F0}\ProgID\ = "ICWCONN.ISPData.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99BA617B-219E-11D2-AE1B-0000F87734F0}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.WebView\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B79EEAD-2728-11D2-8D58-0000F87734F0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\abba00e181c1e18d7d624212f1ed2392ee3433c4d9f978c424010a3efe1fc98c.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.ISPData\CurVer\ = "ICWCONN.ISPData.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.GifConvert.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B79EEAD-2728-11D2-8D58-0000F87734F0}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.ISPData\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99BA617B-219E-11D2-AE1B-0000F87734F0}\ = "CLSID_ICWWebView"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99BA617B-219E-11D2-AE1B-0000F87734F0}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.GifConvert.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{29548507-3886-11D2-8D63-0000F87734F0}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F832C2B2-312D-11D2-8D5F-0000F87734F0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.GifConvert\ = "CLSID_ICWGifConvert"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.Walker.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.Walker.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F832C2B2-312D-11D2-8D5F-0000F87734F0}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F832C2B2-312D-11D2-8D5F-0000F87734F0}\ProgID\ = "ICWCONN.GifConvert.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ICWCONN.GifConvert.1\CLSID\ = "{F832C2B2-312D-11D2-8D5F-0000F87734F0}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 2976	1428	regsvr32.exe	81
PID 1428 wrote to memory of 2976	1428	regsvr32.exe	81
PID 1428 wrote to memory of 2976	1428	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\abba00e181c1e18d7d624212f1ed2392ee3433c4d9f978c424010a3efe1fc98c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\abba00e181c1e18d7d624212f1ed2392ee3433c4d9f978c424010a3efe1fc98c.dll
  2⤵
  - Modifies registry class
  PID:2976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2976-133-0x000000007CFC0000-0x000000007CFD7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads