cb545fa497e5ade9d8cbc53d7fa45736311f2c6b3c732ed5a55cd5e6a193312c

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/04/2023, 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb545fa497e5ade9d8cbc53d7fa45736311f2c6b3c732ed5a55cd5e6a193312c.dll
Size

1.6MB
MD5

a6d59a7947b82180babd47d99c184b13
SHA1

9403af296132317b4162ee111d6d1b9cff0434ea
SHA256

cb545fa497e5ade9d8cbc53d7fa45736311f2c6b3c732ed5a55cd5e6a193312c
SHA512

528dfefa9c4c39097fdd9231f456a1ca5605cf54a85562e239d93634e27117b152c1958670b198934a52ac9ff35d5c7e3b6d2208c266751995e32feef2bbb025
SSDEEP

49152:OAVBgRSA6xcBtR/qCkwMkVD71fscXHOuFMF:Tga2pvVX1fnXHOuS

Score

1^/10

Malware Config

Signatures

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A6D8BBF-5FBA-4D76-93D7-67DF0A12B35C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A6D8BBF-5FBA-4D76-93D7-67DF0A12B35C}\VERSION\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rEOAxF.Set\Clsid\ = "{4A6D8BBF-5FBA-4D76-93D7-67DF0A12B35C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33166FA5-E7B5-4515-BF5C-7F1EC51B4915}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33166FA5-E7B5-4515-BF5C-7F1EC51B4915}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A6D8BBF-5FBA-4D76-93D7-67DF0A12B35C}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{5CCF1475-54CB-44A7-928C-F5577FB8AC6D}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33166FA5-E7B5-4515-BF5C-7F1EC51B4915}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33166FA5-E7B5-4515-BF5C-7F1EC51B4915}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33166FA5-E7B5-4515-BF5C-7F1EC51B4915}\ = "_Set"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A6D8BBF-5FBA-4D76-93D7-67DF0A12B35C}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{5CCF1475-54CB-44A7-928C-F5577FB8AC6D}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{5CCF1475-54CB-44A7-928C-F5577FB8AC6D}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{5CCF1475-54CB-44A7-928C-F5577FB8AC6D}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{5CCF1475-54CB-44A7-928C-F5577FB8AC6D}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A6D8BBF-5FBA-4D76-93D7-67DF0A12B35C}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{5CCF1475-54CB-44A7-928C-F5577FB8AC6D}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33166FA5-E7B5-4515-BF5C-7F1EC51B4915}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A6D8BBF-5FBA-4D76-93D7-67DF0A12B35C}\ = "rEOAxF.Set"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rEOAxF.Set\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33166FA5-E7B5-4515-BF5C-7F1EC51B4915}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rEOAxF.Set	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33166FA5-E7B5-4515-BF5C-7F1EC51B4915}\ = "Set"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33166FA5-E7B5-4515-BF5C-7F1EC51B4915}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33166FA5-E7B5-4515-BF5C-7F1EC51B4915}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A6D8BBF-5FBA-4D76-93D7-67DF0A12B35C}\ProgID\ = "rEOAxF.Set"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A6D8BBF-5FBA-4D76-93D7-67DF0A12B35C}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A6D8BBF-5FBA-4D76-93D7-67DF0A12B35C}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{5CCF1475-54CB-44A7-928C-F5577FB8AC6D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33166FA5-E7B5-4515-BF5C-7F1EC51B4915}\ = "_Set"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33166FA5-E7B5-4515-BF5C-7F1EC51B4915}\TypeLib\ = "{5CCF1475-54CB-44A7-928C-F5577FB8AC6D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33166FA5-E7B5-4515-BF5C-7F1EC51B4915}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33166FA5-E7B5-4515-BF5C-7F1EC51B4915}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33166FA5-E7B5-4515-BF5C-7F1EC51B4915}\TypeLib\ = "{5CCF1475-54CB-44A7-928C-F5577FB8AC6D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A6D8BBF-5FBA-4D76-93D7-67DF0A12B35C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A6D8BBF-5FBA-4D76-93D7-67DF0A12B35C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cb545fa497e5ade9d8cbc53d7fa45736311f2c6b3c732ed5a55cd5e6a193312c.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{5CCF1475-54CB-44A7-928C-F5577FB8AC6D}\1.0\ = "rEOAxF"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{5CCF1475-54CB-44A7-928C-F5577FB8AC6D}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33166FA5-E7B5-4515-BF5C-7F1EC51B4915}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33166FA5-E7B5-4515-BF5C-7F1EC51B4915}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A6D8BBF-5FBA-4D76-93D7-67DF0A12B35C}\TypeLib\ = "{5CCF1475-54CB-44A7-928C-F5577FB8AC6D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{5CCF1475-54CB-44A7-928C-F5577FB8AC6D}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cb545fa497e5ade9d8cbc53d7fa45736311f2c6b3c732ed5a55cd5e6a193312c.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A6D8BBF-5FBA-4D76-93D7-67DF0A12B35C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rEOAxF.Set\ = "rEOAxF.Set"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4A6D8BBF-5FBA-4D76-93D7-67DF0A12B35C}\Implemented Categories	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2012	2000	regsvr32.exe	28
PID 2000 wrote to memory of 2012	2000	regsvr32.exe	28
PID 2000 wrote to memory of 2012	2000	regsvr32.exe	28
PID 2000 wrote to memory of 2012	2000	regsvr32.exe	28
PID 2000 wrote to memory of 2012	2000	regsvr32.exe	28
PID 2000 wrote to memory of 2012	2000	regsvr32.exe	28
PID 2000 wrote to memory of 2012	2000	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cb545fa497e5ade9d8cbc53d7fa45736311f2c6b3c732ed5a55cd5e6a193312c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cb545fa497e5ade9d8cbc53d7fa45736311f2c6b3c732ed5a55cd5e6a193312c.dll
  2⤵
  - Modifies registry class
  PID:2012

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads