6a05f453c4d10262fd44cf9e4d6419bb39c24d99408852d9932db90d223b805d

Analysis

max time kernel
127s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28-08-2023 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a05f453c4d10262fd44cf9e4d6419bb39c24d99408852d9932db90d223b805d.dll
Size

757KB
MD5

5e2b38a5dc9d70017863ee70481eb014
SHA1

ae250938987330945338f9831513d62a742298cb
SHA256

6a05f453c4d10262fd44cf9e4d6419bb39c24d99408852d9932db90d223b805d
SHA512

eca63aac154ab03b9da74b7a164c72c12e2494aa9faf700d1691f5309b5bab37c1b7ae3c0546bec091e54ac6ca65996c15c762fe94a19f4ae547c4533cb54c90
SSDEEP

12288:SD2V9Syzw+2QOgrRUfZyUrDUX7+l48ZIWby3vTi/:SD22ycT0ifZyUrDUX8bqvTi/

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA1}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E572D3C9-37BE-4AE2-825D-D521763E3108}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE4106E0-399A-11D0-A48C-00A0C90A8F39}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85CB6900-4D95-11CF-960C-0080C7F4EE85}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{729FE2F8-1EA8-11D1-8F85-00C04FC2FBE1}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47C922A2-3DD5-11D2-BF8B-00C04FB93661}\TypeLib\ = "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\http\URL Protocol	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0002DF05-0000-0000-C000-000000000046}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\mailto\URL Protocol	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1611FDDA-445B-11D2-85DE-00C04FA35C89}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64AB4BB7-111E-11d1-8F79-00C04FC2FBE1}\VersionIndependentProgId	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6a05f453c4d10262fd44cf9e4d6419bb39c24d99408852d9932db90d223b805d.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47C922A2-3DD5-11D2-BF8B-00C04FB93661}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6a05f453c4d10262fd44cf9e4d6419bb39c24d99408852d9932db90d223b805d.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\ProgId\ = "ShellNameSpace.ShellNameSpace.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\ProgId\ = "SearchAssistantOC.SearchAssistantOC.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.url	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.url\ = "InternetShortcut"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1611FDDA-445B-11D2-85DE-00C04FA35C89}\TypeLib\ = "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D}\TypeLib\ = "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\NeverShowExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47C922A2-3DD5-11D2-BF8B-00C04FB93661}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\ = "Internet Shortcut"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BA9239A4-3DD5-11D2-BF8B-00C04FB93661}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55136804-B2DE-11D1-B9F2-00A0C98BC547}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchAssistantOC.SearchAssistantOC\ = "SearchAssistantOC"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\EditFlags = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A7FE6EDA-1932-4281-B881-87B31B8BC52C}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\VersionIndependentProgId	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55136805-B2DE-11D1-B9F2-00A0C98BC547}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\IsShortcut	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.URL\ShellEx\{000214EE-0000-0000-C000-000000000046}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47C922A2-3DD5-11D2-BF8B-00C04FB93661}\ = "ISearches"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47C922A2-3DD5-11D2-BF8B-00C04FB93661}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA2}\TypeLib\ = "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA3}\TypeLib\ = "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6a05f453c4d10262fd44cf9e4d6419bb39c24d99408852d9932db90d223b805d.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\ProgId	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}\TypeLib\ = "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55136806-B2DE-11D1-B9F2-00A0C98BC547}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.URL\ShellEx\{CABB0DA0-DA57-11CF-9974-0020AFD79762}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E71FD0F-AAB1-42C0-9146-6D2C4EDCF07D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\https\URL Protocol	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A}\ = "Shell Name Space"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BA9239A4-3DD5-11D2-BF8B-00C04FB93661}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72423E8F-8011-11D2-BE79-00A0C9A83DA2}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64AB4BB7-111E-11d1-8F79-00C04FC2FBE1}\Version	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2064	2172	regsvr32.exe	83
PID 2172 wrote to memory of 2064	2172	regsvr32.exe	83
PID 2172 wrote to memory of 2064	2172	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6a05f453c4d10262fd44cf9e4d6419bb39c24d99408852d9932db90d223b805d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6a05f453c4d10262fd44cf9e4d6419bb39c24d99408852d9932db90d223b805d.dll
  2⤵
  - Modifies registry class
  PID:2064

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads