12d32581acbfcfe59576440e3f182c098c29a0f1735efe7452690a686123fce1

Analysis

max time kernel
359s
max time network
370s
platform
windows7_x64
resource
win7-20230712-es
resource tags

arch:x64arch:x86image:win7-20230712-eslocale:es-esos:windows7-x64systemwindows
submitted
02/08/2023, 23:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Common Files/CDWriter.dll
Size

85KB
MD5

67cbd08a6db314bda975ce866677d40f
SHA1

db88c348f09c4176155457f4542db22e800a2f12
SHA256

cb606ecc3f4a3b72dacfd53ce4853dff36310d0a4bd9edcdb155b31b88d573a3
SHA512

99d66d14cc8acff9a5736c1b699211b0edee1aac4bc796fcd1b1854c23aa436dfb0d79758c50b81dd9e98ed71038261fae3e167c169132df311e45d1e944d1dd
SSDEEP

1536:xfJ2tkwQHkSZnLxK3UPDZtbjkxd+YUFTsCT+ouB6+0dkdDrlorrsGeQOt0jyyoEK:nBZN7ZZIUmCaoEt0dkdvlgsIOtNyDR

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A022063F-6563-44DC-BC81-9435AFB5D2DF}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DBC77A91-FD1D-4FAD-BE79-22241466DB97}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A022063F-6563-44DC-BC81-9435AFB5D2DF}\ProgID\ = "Integral.Common.CDWriter.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A022063F-6563-44DC-BC81-9435AFB5D2DF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Common Files\\CDWriter.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DBC77A91-FD1D-4FAD-BE79-22241466DB97}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DBC77A91-FD1D-4FAD-BE79-22241466DB97}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9CBD1B4-BFDF-4C5D-B408-5FB21316E07B}\TypeLib\ = "{DBC77A91-FD1D-4FAD-BE79-22241466DB97}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B1F211C-83DC-46C6-8977-627586EDE3A8}\TypeLib\ = "{DBC77A91-FD1D-4FAD-BE79-22241466DB97}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CC3134E1-68DF-4DEE-AF39-649CC0A769CF}\ = "Integral.Common.CDWriter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DBC77A91-FD1D-4FAD-BE79-22241466DB97}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Common Files\\CDWriter.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F9CBD1B4-BFDF-4C5D-B408-5FB21316E07B}\TypeLib\ = "{DBC77A91-FD1D-4FAD-BE79-22241466DB97}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Integral.Common.CDWriter\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F9CBD1B4-BFDF-4C5D-B408-5FB21316E07B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8B1F211C-83DC-46C6-8977-627586EDE3A8}\ = "_ICDWriterEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\CDWriter.DLL	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Integral.Common.CDWriter\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A022063F-6563-44DC-BC81-9435AFB5D2DF}\VersionIndependentProgID\ = "Integral.Common.CDWriter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DBC77A91-FD1D-4FAD-BE79-22241466DB97}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9CBD1B4-BFDF-4C5D-B408-5FB21316E07B}\ = "ICDWriter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Integral.Common.CDWriter.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Integral.Common.CDWriter	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Integral.Common.CDWriter\ = "Integral CDWriter Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A022063F-6563-44DC-BC81-9435AFB5D2DF}\AppID = "{CC3134E1-68DF-4DEE-AF39-649CC0A769CF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DBC77A91-FD1D-4FAD-BE79-22241466DB97}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Common Files"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8B1F211C-83DC-46C6-8977-627586EDE3A8}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CC3134E1-68DF-4DEE-AF39-649CC0A769CF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\CDWriter.DLL\AppID = "{CC3134E1-68DF-4DEE-AF39-649CC0A769CF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B1F211C-83DC-46C6-8977-627586EDE3A8}\ = "_ICDWriterEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B1F211C-83DC-46C6-8977-627586EDE3A8}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Integral.Common.CDWriter.1\CLSID\ = "{A022063F-6563-44DC-BC81-9435AFB5D2DF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A022063F-6563-44DC-BC81-9435AFB5D2DF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A022063F-6563-44DC-BC81-9435AFB5D2DF}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8B1F211C-83DC-46C6-8977-627586EDE3A8}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Integral.Common.CDWriter.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A022063F-6563-44DC-BC81-9435AFB5D2DF}\ = "CDWriter Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A022063F-6563-44DC-BC81-9435AFB5D2DF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DBC77A91-FD1D-4FAD-BE79-22241466DB97}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F9CBD1B4-BFDF-4C5D-B408-5FB21316E07B}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9CBD1B4-BFDF-4C5D-B408-5FB21316E07B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9CBD1B4-BFDF-4C5D-B408-5FB21316E07B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8B1F211C-83DC-46C6-8977-627586EDE3A8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8B1F211C-83DC-46C6-8977-627586EDE3A8}\TypeLib\ = "{DBC77A91-FD1D-4FAD-BE79-22241466DB97}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DBC77A91-FD1D-4FAD-BE79-22241466DB97}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DBC77A91-FD1D-4FAD-BE79-22241466DB97}\1.0\ = "Integral.Common.CDWriter 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F9CBD1B4-BFDF-4C5D-B408-5FB21316E07B}\ = "ICDWriter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8B1F211C-83DC-46C6-8977-627586EDE3A8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A022063F-6563-44DC-BC81-9435AFB5D2DF}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DBC77A91-FD1D-4FAD-BE79-22241466DB97}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F9CBD1B4-BFDF-4C5D-B408-5FB21316E07B}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9CBD1B4-BFDF-4C5D-B408-5FB21316E07B}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9CBD1B4-BFDF-4C5D-B408-5FB21316E07B}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B1F211C-83DC-46C6-8977-627586EDE3A8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Integral.Common.CDWriter.1\ = "Integral CDWriter Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F9CBD1B4-BFDF-4C5D-B408-5FB21316E07B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B1F211C-83DC-46C6-8977-627586EDE3A8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B1F211C-83DC-46C6-8977-627586EDE3A8}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Integral.Common.CDWriter\CurVer\ = "Integral.Common.CDWriter.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A022063F-6563-44DC-BC81-9435AFB5D2DF}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9CBD1B4-BFDF-4C5D-B408-5FB21316E07B}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A022063F-6563-44DC-BC81-9435AFB5D2DF}\TypeLib\ = "{DBC77A91-FD1D-4FAD-BE79-22241466DB97}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F9CBD1B4-BFDF-4C5D-B408-5FB21316E07B}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8B1F211C-83DC-46C6-8977-627586EDE3A8}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B1F211C-83DC-46C6-8977-627586EDE3A8}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Integral.Common.CDWriter\CLSID\ = "{A022063F-6563-44DC-BC81-9435AFB5D2DF}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2096	1940	regsvr32.exe	28
PID 1940 wrote to memory of 2096	1940	regsvr32.exe	28
PID 1940 wrote to memory of 2096	1940	regsvr32.exe	28
PID 1940 wrote to memory of 2096	1940	regsvr32.exe	28
PID 1940 wrote to memory of 2096	1940	regsvr32.exe	28
PID 1940 wrote to memory of 2096	1940	regsvr32.exe	28
PID 1940 wrote to memory of 2096	1940	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Common Files\CDWriter.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\Common Files\CDWriter.dll"
  2⤵
  - Modifies registry class
  PID:2096

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads