b1370e087876367d2190c4e41630f17ff973b963f43e25a55ab93236c6d562ee

Analysis

max time kernel
39s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2023, 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Microsoft.Uev.AgentWmi.dll
Size

1.0MB
MD5

10528ca8bdfd1f0a8031b7643e2ba488
SHA1

2de145bc2cc1cc3dd3598b9034fc8554efb56254
SHA256

b1370e087876367d2190c4e41630f17ff973b963f43e25a55ab93236c6d562ee
SHA512

ca9a7161b459c47d49d5a13ab44d5ff17bc03a780b35d2587899010b4b9ae29503a8f484160b7e829e169e05d77361248310d2eb58d409b6811048523b635fc7
SSDEEP

24576:GX4lEqOyfL/TKcJpDffb4iqosljiodMg+DW9YM0h3a73aEW1HANFr3X+L+qd5an9:GolfybdOD64YKEW1gNFrHud5an9

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}\Version	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{523A581F-EC58-40CE-99D3-36BF7897F3EC}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{523A581F-EC58-40CE-99D3-36BF7897F3EC}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{523A581F-EC58-40CE-99D3-36BF7897F3EC}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC231970-6AFD-4215-A72E-97242BB08680}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55F7B88D-A254-4B22-B7BB-FCDBBA1AFA32}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft.Uev.AgentWmi.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0438D53A-9A57-423C-9E54-9612C4576257}\1.0\0\win32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}\InProcServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7E9D3B9-E62B-4A90-8CC5-A3C5F662DA7B}\InProcServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A571F412-E3D2-4A32-BF42-1D3B2203FF17}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C0B0642-1DEB-43DF-8032-7A9BF5811A74}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C0B0642-1DEB-43DF-8032-7A9BF5811A74}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C0B0642-1DEB-43DF-8032-7A9BF5811A74}\TypeLib\ = "{0438D53A-9A57-423C-9E54-9612C4576257}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0438D53A-9A57-423C-9E54-9612C4576257}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{523A581F-EC58-40CE-99D3-36BF7897F3EC}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A571F412-E3D2-4A32-BF42-1D3B2203FF17}\Version\ = "1.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC231970-6AFD-4215-A72E-97242BB08680}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55F7B88D-A254-4B22-B7BB-FCDBBA1AFA32}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7E9D3B9-E62B-4A90-8CC5-A3C5F662DA7B}\ = "ConfigurationProvider Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A571F412-E3D2-4A32-BF42-1D3B2203FF17}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A571F412-E3D2-4A32-BF42-1D3B2203FF17}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A571F412-E3D2-4A32-BF42-1D3B2203FF17}\TypeLib\ = "{0438D53A-9A57-423C-9E54-9612C4576257}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC231970-6AFD-4215-A72E-97242BB08680}\ = "UevConfigurationProvider Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55F7B88D-A254-4B22-B7BB-FCDBBA1AFA32}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55F7B88D-A254-4B22-B7BB-FCDBBA1AFA32}\TypeLib\ = "{0438D53A-9A57-423C-9E54-9612C4576257}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C0B0642-1DEB-43DF-8032-7A9BF5811A74}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55F7B88D-A254-4B22-B7BB-FCDBBA1AFA32}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C0B0642-1DEB-43DF-8032-7A9BF5811A74}\ = "UserSettingsProvider Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}\ = "ComputerConfigurationProvider Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7E9D3B9-E62B-4A90-8CC5-A3C5F662DA7B}\Version\ = "1.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A571F412-E3D2-4A32-BF42-1D3B2203FF17}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A571F412-E3D2-4A32-BF42-1D3B2203FF17}\ = "SettingsLocationTemplateProvider Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55F7B88D-A254-4B22-B7BB-FCDBBA1AFA32}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0438D53A-9A57-423C-9E54-9612C4576257}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7E9D3B9-E62B-4A90-8CC5-A3C5F662DA7B}\Version	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{523A581F-EC58-40CE-99D3-36BF7897F3EC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C0B0642-1DEB-43DF-8032-7A9BF5811A74}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}\Version\ = "1.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{523A581F-EC58-40CE-99D3-36BF7897F3EC}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC231970-6AFD-4215-A72E-97242BB08680}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C0B0642-1DEB-43DF-8032-7A9BF5811A74}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}\TypeLib\ = "{0438D53A-9A57-423C-9E54-9612C4576257}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{523A581F-EC58-40CE-99D3-36BF7897F3EC}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7E9D3B9-E62B-4A90-8CC5-A3C5F662DA7B}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC231970-6AFD-4215-A72E-97242BB08680}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC231970-6AFD-4215-A72E-97242BB08680}\TypeLib\ = "{0438D53A-9A57-423C-9E54-9612C4576257}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C0B0642-1DEB-43DF-8032-7A9BF5811A74}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C0B0642-1DEB-43DF-8032-7A9BF5811A74}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4950C79-806D-4ECE-9DB1-11B34D33F514}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft.Uev.AgentWmi.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7E9D3B9-E62B-4A90-8CC5-A3C5F662DA7B}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A571F412-E3D2-4A32-BF42-1D3B2203FF17}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC231970-6AFD-4215-A72E-97242BB08680}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC231970-6AFD-4215-A72E-97242BB08680}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55F7B88D-A254-4B22-B7BB-FCDBBA1AFA32}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{523A581F-EC58-40CE-99D3-36BF7897F3EC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7E9D3B9-E62B-4A90-8CC5-A3C5F662DA7B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A571F412-E3D2-4A32-BF42-1D3B2203FF17}\Version	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55F7B88D-A254-4B22-B7BB-FCDBBA1AFA32}\InProcServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 4416	4744	regsvr32.exe	85
PID 4744 wrote to memory of 4416	4744	regsvr32.exe	85
PID 4744 wrote to memory of 4416	4744	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Microsoft.Uev.AgentWmi.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Microsoft.Uev.AgentWmi.dll
  2⤵
  - Modifies registry class
  PID:4416

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads