0c6807228fb769b442914009cdca3b4e5d3908946c1af9a357ca653f5757a855

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c6807228fb769b442914009cdca3b4e5d3908946c1af9a357ca653f5757a855.dll
Size

483KB
MD5

cf1757b307d932741357e62877ee40d1
SHA1

15a092550264152350522026e8b1f5f403f70098
SHA256

0c6807228fb769b442914009cdca3b4e5d3908946c1af9a357ca653f5757a855
SHA512

4201e9e6e86c99c1b08e4ae6c61fc13c7b19473b3d22e1b8df1a3e5ca378865fa3f9dd5fbd412bf129a629b728487948f1703423cd41aa07c402b718a21e4a89
SSDEEP

6144:ZUscCtkzWyuViExP1O5MttWNUg4A5s8IROxeVYCEyVFS+xcRlBvfHMr95HOcekf+:iWiWyuViExP1O5MttWu8+63BvcOc3kv

Score

1^/10

Malware Config

Signatures

Modifies registry class 53 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{845B0FB2-66E0-416B-8F91-314E23F7C12D}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.RegFolder\CurVer\ = "NTObjShEx.RegFolder.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.NTDirectory	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\WOW6432Node\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6D6E08-2332-4A7B-A94D-6432DB2B5AE6}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6D6E08-2332-4A7B-A94D-6432DB2B5AE6}\InfoTip = "@C:\\Users\\Admin\\AppData\\Local\\Temp\\0c6807228fb769b442914009cdca3b4e5d3908946c1af9a357ca653f5757a855.dll,-104"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.NTDirectory\ = "NT Namespace Directory Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.NTDirectory\CurVer\ = "NTObjShEx.NTDirectory.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.NTDirectory\CLSID\ = "{845B0FB2-66E0-416B-8F91-314E23F7C12D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{845B0FB2-66E0-416B-8F91-314E23F7C12D}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.RegFolder\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6D6E08-2332-4A7B-A94D-6432DB2B5AE6}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{845B0FB2-66E0-416B-8F91-314E23F7C12D}\ProgID\ = "NTObjShEx.NTDirectory.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.RegFolder\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6D6E08-2332-4A7B-A94D-6432DB2B5AE6}\InprocServer32	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6D6E08-2332-4A7B-A94D-6432DB2B5AE6}\ShellFolder\BrowserFlags = "34"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{845B0FB2-66E0-416B-8F91-314E23F7C12D}\ShellFolder\Attributes = "2818572288"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6D6E08-2332-4A7B-A94D-6432DB2B5AE6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.NTDirectory.1\ = "NT Namespace Directory Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.NTDirectory\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{845B0FB2-66E0-416B-8F91-314E23F7C12D}\DefaultIcon	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{845B0FB2-66E0-416B-8F91-314E23F7C12D}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0c6807228fb769b442914009cdca3b4e5d3908946c1af9a357ca653f5757a855.dll,0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6D6E08-2332-4A7B-A94D-6432DB2B5AE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0c6807228fb769b442914009cdca3b4e5d3908946c1af9a357ca653f5757a855.dll,-7"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.RegFolder.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.RegFolder.1\CLSID\ = "{1C6D6E08-2332-4A7B-A94D-6432DB2B5AE6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6D6E08-2332-4A7B-A94D-6432DB2B5AE6}\LocalizedString = "@C:\\Users\\Admin\\AppData\\Local\\Temp\\0c6807228fb769b442914009cdca3b4e5d3908946c1af9a357ca653f5757a855.dll,-102"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{845B0FB2-66E0-416B-8F91-314E23F7C12D}\LocalizedString = "@C:\\Users\\Admin\\AppData\\Local\\Temp\\0c6807228fb769b442914009cdca3b4e5d3908946c1af9a357ca653f5757a855.dll,-101"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{845B0FB2-66E0-416B-8F91-314E23F7C12D}\ShellFolder	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6D6E08-2332-4A7B-A94D-6432DB2B5AE6}\ShellFolder\Attributes = "2818572288"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.RegFolder	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.RegFolder.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.RegFolder\CLSID\ = "{1C6D6E08-2332-4A7B-A94D-6432DB2B5AE6}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.NTDirectory\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{845B0FB2-66E0-416B-8F91-314E23F7C12D}\ = "NT Object Namespace Extension"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6D6E08-2332-4A7B-A94D-6432DB2B5AE6}\ = "System Registry Namespace Extension"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.RegFolder.1\ = "Registry Folder Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6D6E08-2332-4A7B-A94D-6432DB2B5AE6}\ProgID\ = "NTObjShEx.RegFolder.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6D6E08-2332-4A7B-A94D-6432DB2B5AE6}\VersionIndependentProgID\ = "NTObjShEx.RegFolder"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6D6E08-2332-4A7B-A94D-6432DB2B5AE6}\DefaultIcon	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6D6E08-2332-4A7B-A94D-6432DB2B5AE6}\ShellFolder	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.NTDirectory.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{845B0FB2-66E0-416B-8F91-314E23F7C12D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0c6807228fb769b442914009cdca3b4e5d3908946c1af9a357ca653f5757a855.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{845B0FB2-66E0-416B-8F91-314E23F7C12D}\InfoTip = "@C:\\Users\\Admin\\AppData\\Local\\Temp\\0c6807228fb769b442914009cdca3b4e5d3908946c1af9a357ca653f5757a855.dll,-103"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.RegFolder\ = "Registry Folder Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.NTDirectory.1\CLSID\ = "{845B0FB2-66E0-416B-8F91-314E23F7C12D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{845B0FB2-66E0-416B-8F91-314E23F7C12D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{845B0FB2-66E0-416B-8F91-314E23F7C12D}\VersionIndependentProgID\ = "NTObjShEx.NTDirectory"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{845B0FB2-66E0-416B-8F91-314E23F7C12D}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{845B0FB2-66E0-416B-8F91-314E23F7C12D}\ShellFolder\BrowserFlags = "34"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NTObjShEx.NTDirectory.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{845B0FB2-66E0-416B-8F91-314E23F7C12D}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6D6E08-2332-4A7B-A94D-6432DB2B5AE6}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C6D6E08-2332-4A7B-A94D-6432DB2B5AE6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0c6807228fb769b442914009cdca3b4e5d3908946c1af9a357ca653f5757a855.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 2360	4052	regsvr32.exe	81
PID 4052 wrote to memory of 2360	4052	regsvr32.exe	81
PID 4052 wrote to memory of 2360	4052	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0c6807228fb769b442914009cdca3b4e5d3908946c1af9a357ca653f5757a855.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0c6807228fb769b442914009cdca3b4e5d3908946c1af9a357ca653f5757a855.dll
  2⤵
  - Modifies registry class
  PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2360-133-0x00000000757D0000-0x0000000075853000-memory.dmp

Filesize
524KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads