12d32581acbfcfe59576440e3f182c098c29a0f1735efe7452690a686123fce1

Analysis

max time kernel
363s
max time network
372s
platform
windows7_x64
resource
win7-20230712-es
resource tags

arch:x64arch:x86image:win7-20230712-eslocale:es-esos:windows7-x64systemwindows
submitted
02/08/2023, 23:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Common Files/ArchiveSampleProvider.dll
Size

83KB
MD5

bd8353da990ab54158fac13ff20e192d
SHA1

b1fa32e85059d4caa7279bf2900dc1600bb4c92b
SHA256

bd54dd7fa4f151e1e37f5416465add35a6b86fc7793a20cb64ecd0728a658cd5
SHA512

d94425f3bef4d7d2fde5b0c401691d7839ecc13ea2f51be8c7e733be0322dfafe4d9aa7d4a33cd310432c76e22e887056f0aa2615844bca0e6e14109853ef3c4
SSDEEP

1536:MXEaYyx97FKoI290NUb3PtlzMieIkAEjCoZB0FolO1fo09byH4:A+M97wi90Kbff+AEj3MUO1fo0QH4

Score

1^/10

Malware Config

Signatures

Modifies registry class 51 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80A226AC-3D05-4583-9B9D-96FD99BCA872}\VersionIndependentProgID\ = "ArchiveSampleProvider.ArchiveStreamSamp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18DE313D-10BC-4A3C-BAA1-122F77847C81}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A63F55C-CD89-498C-982C-96266E849923}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A63F55C-CD89-498C-982C-96266E849923}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A63F55C-CD89-498C-982C-96266E849923}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A63F55C-CD89-498C-982C-96266E849923}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ArchiveSampleProvider.ArchiveStreamSamp	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80A226AC-3D05-4583-9B9D-96FD99BCA872}\ = "CArchiveStreamSampleProvider Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ArchiveSampleProvider.ArchiveStreamSamp\CurVer\ = "ArchiveSampleProvider.ArchiveStreamSa.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ArchiveSampleProvider.ArchiveStreamSamp\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80A226AC-3D05-4583-9B9D-96FD99BCA872}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18DE313D-10BC-4A3C-BAA1-122F77847C81}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18DE313D-10BC-4A3C-BAA1-122F77847C81}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ArchiveSampleProvider.ArchiveStreamSamp\CLSID\ = "{80A226AC-3D05-4583-9B9D-96FD99BCA872}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{18DE313D-10BC-4A3C-BAA1-122F77847C81}\ = "ArchiveSampleProvider"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ArchiveSampleProvider.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ArchiveSampleProvider.DLL\AppID = "{18DE313D-10BC-4A3C-BAA1-122F77847C81}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ArchiveSampleProvider.ArchiveStreamSa.1\ = "CArchiveStreamSampleProvider Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ArchiveSampleProvider.ArchiveStreamSamp\ = "CArchiveStreamSampleProvider Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80A226AC-3D05-4583-9B9D-96FD99BCA872}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18DE313D-10BC-4A3C-BAA1-122F77847C81}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{18DE313D-10BC-4A3C-BAA1-122F77847C81}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A63F55C-CD89-498C-982C-96266E849923}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A63F55C-CD89-498C-982C-96266E849923}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18DE313D-10BC-4A3C-BAA1-122F77847C81}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18DE313D-10BC-4A3C-BAA1-122F77847C81}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Common Files"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A63F55C-CD89-498C-982C-96266E849923}\ = "IArchiveStreamSampleProvider"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A63F55C-CD89-498C-982C-96266E849923}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80A226AC-3D05-4583-9B9D-96FD99BCA872}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80A226AC-3D05-4583-9B9D-96FD99BCA872}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80A226AC-3D05-4583-9B9D-96FD99BCA872}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Common Files\\ArchiveSampleProvider.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80A226AC-3D05-4583-9B9D-96FD99BCA872}\AppID = "{18DE313D-10BC-4A3C-BAA1-122F77847C81}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18DE313D-10BC-4A3C-BAA1-122F77847C81}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18DE313D-10BC-4A3C-BAA1-122F77847C81}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Common Files\\ArchiveSampleProvider.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A63F55C-CD89-498C-982C-96266E849923}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A63F55C-CD89-498C-982C-96266E849923}\TypeLib\ = "{18DE313D-10BC-4A3C-BAA1-122F77847C81}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80A226AC-3D05-4583-9B9D-96FD99BCA872}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A63F55C-CD89-498C-982C-96266E849923}\ = "IArchiveStreamSampleProvider"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A63F55C-CD89-498C-982C-96266E849923}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80A226AC-3D05-4583-9B9D-96FD99BCA872}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80A226AC-3D05-4583-9B9D-96FD99BCA872}\ProgID\ = "ArchiveSampleProvider.ArchiveStreamSa.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80A226AC-3D05-4583-9B9D-96FD99BCA872}\TypeLib\ = "{18DE313D-10BC-4A3C-BAA1-122F77847C81}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18DE313D-10BC-4A3C-BAA1-122F77847C81}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18DE313D-10BC-4A3C-BAA1-122F77847C81}\1.0\ = "ArchiveSampleProvider 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A63F55C-CD89-498C-982C-96266E849923}\TypeLib\ = "{18DE313D-10BC-4A3C-BAA1-122F77847C81}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ArchiveSampleProvider.ArchiveStreamSamp\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ArchiveSampleProvider.ArchiveStreamSa.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ArchiveSampleProvider.ArchiveStreamSa.1\CLSID\ = "{80A226AC-3D05-4583-9B9D-96FD99BCA872}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80A226AC-3D05-4583-9B9D-96FD99BCA872}\InprocServer32\ThreadingModel = "apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A63F55C-CD89-498C-982C-96266E849923}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ArchiveSampleProvider.ArchiveStreamSa.1	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2880	1652	regsvr32.exe	28
PID 1652 wrote to memory of 2880	1652	regsvr32.exe	28
PID 1652 wrote to memory of 2880	1652	regsvr32.exe	28
PID 1652 wrote to memory of 2880	1652	regsvr32.exe	28
PID 1652 wrote to memory of 2880	1652	regsvr32.exe	28
PID 1652 wrote to memory of 2880	1652	regsvr32.exe	28
PID 1652 wrote to memory of 2880	1652	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Common Files\ArchiveSampleProvider.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\Common Files\ArchiveSampleProvider.dll"
  2⤵
  - Modifies registry class
  PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2880-54-0x0000000000350000-0x0000000000381000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads