29b2ddb6cb49f8877a739abb96712f2fcc8f98acefaa8f79ea424215456d1cc2

Analysis

max time kernel
103s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2023 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29b2ddb6cb49f8877a739abb96712f2fcc8f98acefaa8f79ea424215456d1cc2.dll
Size

1.7MB
MD5

b9fb9c8ea3419c4093c4194516c51218
SHA1

bb223eb7c95ffbb333e39f79b16b4e8437416876
SHA256

29b2ddb6cb49f8877a739abb96712f2fcc8f98acefaa8f79ea424215456d1cc2
SHA512

91c7b59e1c796d1f67c86194e114f2abcc8de6501e1aead17804e541f0acc1e69999630160ac29110629bde466503cf95fd22b15c94fbb4f1e33ec19f58fe2b5
SSDEEP

49152:gbPP6zqxlIsjnT4rDLTOsNlafopwmnxkDVmg58E2zmA:W3gqrihlafEwmnCVh+

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{04CEA260-DD00-4954-A81F-F0A201343CB9}\ = "IGRField"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C04A6143-7500-41EF-8062-BD89A0A92D40}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE4B64D4-5B5C-4B74-8470-1CC62F8E9FC9}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5BCB27BB-9750-4B28-9384-77801FB0D4EB}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F623A5E8-4AE4-494E-975B-3C5404428625}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9E920A1-C722-4A81-9FCF-4D5EBFFA21F4}\TypeLib\ = "{4018F953-1BFE-441E-8A04-DC8BA1FF060E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7FD5DC62-DED0-4138-9C48-55F0A0FE7B66}\ProgID\ = "gregn.GRDisplayViewerProps.6"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D40307C2-9342-4C0D-9734-A103418186FE}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48636E6A-758E-46C0-B37A-C2A2CAC9469A}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{07120975-B963-4F75-9B4D-0AC979FEBB5D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C56923D-4012-4D28-8283-1B294C5C2A06}\ = "IGRTextFormat"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04CEA260-DD00-4954-A81F-F0A201343CB9}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{28845384-ED9F-4D2E-986E-D52AC37A108F}\TypeLib\Version = "6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE9AA791-4C55-4E06-A592-08D8DF88A941}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FA44042-1421-46DE-9ACA-A44753FF06C6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D40307C2-9342-4C0D-9734-A103418186FE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08513FC1-CCCE-4603-8DD1-35BA1CA8D1CD}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97502458-7024-4194-9598-5B62001D8C1A}\TypeLib\ = "{4018F953-1BFE-441E-8A04-DC8BA1FF060E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD0A6964-D013-4DB6-96C4-5B1DE0DB8F1C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FBA070AB-385F-4988-B7A1-CE6B72799B48}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE9AA791-4C55-4E06-A592-08D8DF88A941}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24DE1EBE-5D9C-40EC-A11A-21AF7D0C0D36}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{23F65787-D22B-4CA6-BA49-D22B63CA353A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCDB44D7-4E0B-4EB6-A1E2-092689E8A482}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36971202-D715-4AFC-83D4-7C0DDD8872E8}\TypeLib\Version = "6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FBA070AB-385F-4988-B7A1-CE6B72799B48}\ = "IGRDisplayViewer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{44CBB5DE-5AFB-4c3d-8F3F-0F70CA5372AD}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4018F953-1BFE-441E-8A04-DC8BA1FF060E}\6.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE9AA791-4C55-4E06-A592-08D8DF88A941}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83CC68EF-B558-45BB-8023-6C4F3BDADA7B}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83CC68EF-B558-45BB-8023-6C4F3BDADA7B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0574ABEB-B0DA-465D-9EB7-286C00F3628F}\TypeLib\ = "{4018F953-1BFE-441E-8A04-DC8BA1FF060E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9E920A1-C722-4A81-9FCF-4D5EBFFA21F4}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E66EBBF5-ED8D-44E7-8A6C-E6579ADCC7D4}\TypeLib\ = "{4018F953-1BFE-441E-8A04-DC8BA1FF060E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BCB27BB-9750-4B28-9384-77801FB0D4EB}\TypeLib\Version = "6.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3BB506AB-425B-43B0-BC82-28A61FCCF686}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{488B2328-67C0-42D1-A133-303FF60D8AE2}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CA58CB2-2AD1-4ad0-B3CC-5F5C000BBDEE}\VersionIndependentProgID\ = "gregn.GRPrintViewerProps"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5EB6E1E6-00B9-4469-AB22-EE4375D70E39}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60EB191F-5E63-41E7-808F-C66EC7A8EF26}\TypeLib\Version = "6.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FE11B07-22DC-4691-85D7-0469364B4B46}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FE11B07-22DC-4691-85D7-0469364B4B46}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DABF9AD-2396-4C11-BFD7-A5EE39772954}\TypeLib\ = "{4018F953-1BFE-441E-8A04-DC8BA1FF060E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9EF8E78-8E3A-428C-93C5-F52E146CB6FF}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93CD76F7-5439-437F-8FA5-A650F2CA773C}\TypeLib\ = "{4018F953-1BFE-441E-8A04-DC8BA1FF060E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45F9B62D-9E33-484A-BB3C-BD58007BDAA2}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE4B64D4-5B5C-4B74-8470-1CC62F8E9FC9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17B23325-7316-4098-9FE3-B5A1C24DB296}\TypeLib\ = "{4018F953-1BFE-441E-8A04-DC8BA1FF060E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17B23325-7316-4098-9FE3-B5A1C24DB296}\TypeLib\ = "{4018F953-1BFE-441E-8A04-DC8BA1FF060E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60EB191F-5E63-41E7-808F-C66EC7A8EF26}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36971202-D715-4AFC-83D4-7C0DDD8872E8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F803AE1D-B578-490A-A1FE-38976AD2B625}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C765E825-5F52-44CB-AAB6-FA89376DA4C0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1C0E90D-B75A-4FFD-A542-54C9E44785A6}\ = "IGRChartSeriesCollection"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCDB44D7-4E0B-4EB6-A1E2-092689E8A482}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1C0E90D-B75A-4FFD-A542-54C9E44785A6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C04A6148-7500-41EF-8062-BD89A0A92D40}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5D15E31-FA9A-42BE-BE9C-8688E7D9D6A0}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5C2FC87F-12F8-4A09-8A4A-792671C03C74}\TypeLib\Version = "6.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\gregn.GRPrintViewerProps\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83CC68EF-B558-45BB-8023-6C4F3BDADA7B}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81727F33-8D8C-45DC-B525-07ABDC5FB652}\TypeLib\ = "{4018F953-1BFE-441E-8A04-DC8BA1FF060E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9E920A1-C722-4A81-9FCF-4D5EBFFA21F4}\TypeLib\ = "{4018F953-1BFE-441E-8A04-DC8BA1FF060E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{23F65787-D22B-4CA6-BA49-D22B63CA353A}\TypeLib\ = "{4018F953-1BFE-441E-8A04-DC8BA1FF060E}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 4284	2808	regsvr32.exe	88
PID 2808 wrote to memory of 4284	2808	regsvr32.exe	88
PID 2808 wrote to memory of 4284	2808	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\29b2ddb6cb49f8877a739abb96712f2fcc8f98acefaa8f79ea424215456d1cc2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\29b2ddb6cb49f8877a739abb96712f2fcc8f98acefaa8f79ea424215456d1cc2.dll
  2⤵
  - Modifies registry class
  PID:4284

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads