de5365e883feb58bbeaab3ab55a22f5ffb11ec52b401e1587b3fd616f2a879d8

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
30/08/2023, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

de5365e883feb58bbeaab3ab55a22f5ffb11ec52b401e1587b3fd616f2a879d8.dll
Size

6.2MB
MD5

008567637af4b0db9fab371bae89d565
SHA1

6b54590975c2345debb680fc2356df0b6d34ddc8
SHA256

de5365e883feb58bbeaab3ab55a22f5ffb11ec52b401e1587b3fd616f2a879d8
SHA512

8e621583fa2639845a89e33a53dcaf445936822cb96e8cf16364280715009b695deead6fefa689d92f0eca9caa62856ed388b8b46e7123c8b1c7dbfcc37970c0
SSDEEP

98304:i4rdrPhoP4qQQ+QV4zmU2OjQL/llOn2rM6FD+obEZA4i7tb8UILQHbxkrKZv25Zf:i4rd6OzUB8Gz3b8UIU7x4W25Zf

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NPWEBCLIENT_9000.npWebClient_9000Ctrl.1\ = "WebClient_VPPlugin_P2P CONN_Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\ = "WebClient_VPPlugin_P2P CONN_Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\de5365e883feb58bbeaab3ab55a22f5ffb11ec52b401e1587b3fd616f2a879d8.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\MiscStatus\1\ = "131473"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9FCCFEE7-737B-45CC-9F71-F4F263ED2166}\1.0\FLAGS\ = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{324C2AE9-E416-4FCA-96B5-C41777E0E166}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9FCCFEE7-737B-45CC-9F71-F4F263ED2166}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AE49F9D6-6B55-46F0-A924-B59D564B7166}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NPWEBCLIENT_9000.npWebClient_9000Ctrl.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\Control\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{556E2FE4-3F01-4A4C-9A8F-879DF6258A53}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{556E2FE4-3F01-4A4C-9A8F-879DF6258A53}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\de5365e883feb58bbeaab3ab55a22f5ffb11ec52b401e1587b3fd616f2a879d8.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{324C2AE9-E416-4FCA-96B5-C41777E0E166}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{324C2AE9-E416-4FCA-96B5-C41777E0E166}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9FCCFEE7-737B-45CC-9F71-F4F263ED2166}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AE49F9D6-6B55-46F0-A924-B59D564B7166}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{324C2AE9-E416-4FCA-96B5-C41777E0E166}\ = "_DnpWebClient_9000Events"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AE49F9D6-6B55-46F0-A924-B59D564B7166}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AE49F9D6-6B55-46F0-A924-B59D564B7166}\ = "_DnpWebClient_9000"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AE49F9D6-6B55-46F0-A924-B59D564B7166}\TypeLib\ = "{9FCCFEE7-737B-45CC-9F71-F4F263ED2166}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{324C2AE9-E416-4FCA-96B5-C41777E0E166}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{324C2AE9-E416-4FCA-96B5-C41777E0E166}\ = "_DnpWebClient_9000Events"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AE49F9D6-6B55-46F0-A924-B59D564B7166}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AE49F9D6-6B55-46F0-A924-B59D564B7166}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{324C2AE9-E416-4FCA-96B5-C41777E0E166}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\de5365e883feb58bbeaab3ab55a22f5ffb11ec52b401e1587b3fd616f2a879d8.dll, 1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9FCCFEE7-737B-45CC-9F71-F4F263ED2166}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{324C2AE9-E416-4FCA-96B5-C41777E0E166}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AE49F9D6-6B55-46F0-A924-B59D564B7166}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{324C2AE9-E416-4FCA-96B5-C41777E0E166}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9FCCFEE7-737B-45CC-9F71-F4F263ED2166}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AE49F9D6-6B55-46F0-A924-B59D564B7166}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{324C2AE9-E416-4FCA-96B5-C41777E0E166}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NPWEBCLIENT_9000.npWebClient_9000Ctrl.1\CLSID\ = "{6334C1EB-5F19-430A-A41B-D7B4BBE65166}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9FCCFEE7-737B-45CC-9F71-F4F263ED2166}\1.0\ = "npWebClient_9000Lib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9FCCFEE7-737B-45CC-9F71-F4F263ED2166}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{556E2FE4-3F01-4A4C-9A8F-879DF6258A53}\ = "npWebClient_9000 Property Page"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AE49F9D6-6B55-46F0-A924-B59D564B7166}\ = "_DnpWebClient_9000"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{324C2AE9-E416-4FCA-96B5-C41777E0E166}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{324C2AE9-E416-4FCA-96B5-C41777E0E166}\TypeLib\ = "{9FCCFEE7-737B-45CC-9F71-F4F263ED2166}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{324C2AE9-E416-4FCA-96B5-C41777E0E166}\TypeLib\ = "{9FCCFEE7-737B-45CC-9F71-F4F263ED2166}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6334C1EB-5F19-430A-A41B-D7B4BBE65166}\TypeLib\ = "{9FCCFEE7-737B-45CC-9F71-F4F263ED2166}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9FCCFEE7-737B-45CC-9F71-F4F263ED2166}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\de5365e883feb58bbeaab3ab55a22f5ffb11ec52b401e1587b3fd616f2a879d8.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AE49F9D6-6B55-46F0-A924-B59D564B7166}\TypeLib\ = "{9FCCFEE7-737B-45CC-9F71-F4F263ED2166}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{556E2FE4-3F01-4A4C-9A8F-879DF6258A53}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NPWEBCLIENT_9000.npWebClient_9000Ctrl.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9FCCFEE7-737B-45CC-9F71-F4F263ED2166}\1.0\HELPDIR\	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 1728	3016	regsvr32.exe	28
PID 3016 wrote to memory of 1728	3016	regsvr32.exe	28
PID 3016 wrote to memory of 1728	3016	regsvr32.exe	28
PID 3016 wrote to memory of 1728	3016	regsvr32.exe	28
PID 3016 wrote to memory of 1728	3016	regsvr32.exe	28
PID 3016 wrote to memory of 1728	3016	regsvr32.exe	28
PID 3016 wrote to memory of 1728	3016	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\de5365e883feb58bbeaab3ab55a22f5ffb11ec52b401e1587b3fd616f2a879d8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\de5365e883feb58bbeaab3ab55a22f5ffb11ec52b401e1587b3fd616f2a879d8.dll
  2⤵
  - Modifies registry class
  PID:1728

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads