Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10-10-2023 11:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Change My Software 7 Edition/Change My Software 7 Edition.exe
Resource
win7-20230831-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Change My Software 7 Edition/Change My Software 7 Edition.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Change My Software 7 Edition/device_test.dll
Resource
win7-20230831-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
Change My Software 7 Edition/device_test.dll
Resource
win10v2004-20230915-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
Change My Software 7 Edition/readme.htm
Resource
win7-20230831-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
Change My Software 7 Edition/readme.htm
Resource
win10v2004-20230915-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
Change My Software 7 Edition/device_test.dll
-
Size
4.2MB
-
MD5
985f5a7de8e1408f8231c23db0e292e5
-
SHA1
aa2e99776934c5d756178bd258b777fffd687f25
-
SHA256
10553029be09e8a7a0d2a5a245271c6a5d7ccbe529af2cd935a505829d8c2f45
-
SHA512
034a6693c7d148ff324d6bcaffb761b6a381977b4348bc7db7c7631c1a585d91e591e974c85d3aa3dff9cb0404d2aa49d3451a7b0717c471f9c62723d256297f
-
SSDEEP
98304:RDrYV2B9qPHogmf5JJwi0kadeijQYl8r7EwTIjvXd:WV2MyNkXQIB
Score
1/10
Malware Config
Signatures
-
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vb.10.0\AlwaysShowExt = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vbproj.10.0\DefaultIcon regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4CB32F8-F8DC-11D2-A4AE-00C04F68FC81}\1.0\FLAGS\ = "4" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B4CB32FF-F8DC-11D2-A4AE-00C04F68FC81} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B4CB32FF-F8DC-11D2-A4AE-00C04F68FC81}\TypeLib\ = "{B4CB32F8-F8DC-11D2-A4AE-00C04F68FC81}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D07E0DC6-5193-4E31-B781-F17E005EEF9C}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B4CB32FF-F8DC-11D2-A4AE-00C04F68FC81}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D07E0DC6-5193-4E31-B781-F17E005EEF9C}\ = "IVBTextEditSpecific" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vb.10.0\shell\Open regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vb.10.0\shell\Open\ddeexec regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbproj\OpenWithProgids\VisualStudio.vbproj.10.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vbproj.10.0\ = "Visual Basic Project file" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B4CB32FF-F8DC-11D2-A4AE-00C04F68FC81} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vb\OpenWithList\devenv.exe regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vb\OpenWithProgids\VisualStudio.vb.10.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4CB32F8-F8DC-11D2-A4AE-00C04F68FC81}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B4CB32FF-F8DC-11D2-A4AE-00C04F68FC81}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D07E0DC6-5193-4E31-B781-F17E005EEF9C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D07E0DC6-5193-4E31-B781-F17E005EEF9C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbproj\OpenWithList\VSLauncher.exe regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vb\Content Type = "text/plain" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbproj\Content Type = "text/plain" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4CB32F8-F8DC-11D2-A4AE-00C04F68FC81}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4CB32F8-F8DC-11D2-A4AE-00C04F68FC81}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B4CB32FF-F8DC-11D2-A4AE-00C04F68FC81}\TypeLib\ = "{B4CB32F8-F8DC-11D2-A4AE-00C04F68FC81}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B4CB32FF-F8DC-11D2-A4AE-00C04F68FC81}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D07E0DC6-5193-4E31-B781-F17E005EEF9C}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vb.10.0\shell\Open\ddeexec\ = "Open(\"%1\")" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vb.10.0\shell\Open\ddeexec\Application\ = "VisualStudio.10.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vb.10.0\shell\Open\ddeexec\Topic\ = "system" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbproj\OpenWithList\VSLauncher.exe\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vbproj.10.0\shell\Open\Command regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B4CB32FF-F8DC-11D2-A4AE-00C04F68FC81}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B4CB32FF-F8DC-11D2-A4AE-00C04F68FC81}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vb.10.0\DefaultIcon regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4CB32F8-F8DC-11D2-A4AE-00C04F68FC81}\1.0\ = "VxExtensibility" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D07E0DC6-5193-4E31-B781-F17E005EEF9C}\ = "IVBTextEditSpecific" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vb.10.0\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Change My Software 7 Edition\\device_test.dll,1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D07E0DC6-5193-4E31-B781-F17E005EEF9C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vb\PerceivedType = "text" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B4CB32FF-F8DC-11D2-A4AE-00C04F68FC81}\ = "IVxEventsRoot" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vb.10.0\shell regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vbproj.10.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vb\OpenWithProgids\Shared regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4CB32F8-F8DC-11D2-A4AE-00C04F68FC81} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D07E0DC6-5193-4E31-B781-F17E005EEF9C}\TypeLib\ = "{B4CB32F8-F8DC-11D2-A4AE-00C04F68FC81}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vb.10.0\shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\devenv.exe\" /dde" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vb.10.0\shell\Open\ddeexec\Application regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vbproj.10.0\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Change My Software 7 Edition\\device_test.dll,0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B4CB32FF-F8DC-11D2-A4AE-00C04F68FC81}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B4CB32FF-F8DC-11D2-A4AE-00C04F68FC81}\ = "IVxEventsRoot" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D07E0DC6-5193-4E31-B781-F17E005EEF9C}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vb\OpenWithList\devenv.exe\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vb.10.0\ = "Visual Basic Source file" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4CB32F8-F8DC-11D2-A4AE-00C04F68FC81}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Change My Software 7 Edition\\device_test.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vb.10.0\shell\Open\ddeexec\Topic regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbproj\OpenWithProgids\Shared regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4CB32F8-F8DC-11D2-A4AE-00C04F68FC81}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Change My Software 7 Edition" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B4CB32FF-F8DC-11D2-A4AE-00C04F68FC81}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbproj\OpenWithList regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vbproj.10.0\shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\VSLauncher.exe\" \"%1\"" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbproj\OpenWithProgids\Shared\ = "Shared key to keep this from being removed with install/uninstall of side-by-side components." regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4CB32F8-F8DC-11D2-A4AE-00C04F68FC81}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B4CB32F8-F8DC-11D2-A4AE-00C04F68FC81}\1.0\HELPDIR regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2452 2216 regsvr32.exe 28 PID 2216 wrote to memory of 2452 2216 regsvr32.exe 28 PID 2216 wrote to memory of 2452 2216 regsvr32.exe 28 PID 2216 wrote to memory of 2452 2216 regsvr32.exe 28 PID 2216 wrote to memory of 2452 2216 regsvr32.exe 28 PID 2216 wrote to memory of 2452 2216 regsvr32.exe 28 PID 2216 wrote to memory of 2452 2216 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Change My Software 7 Edition\device_test.dll"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\Change My Software 7 Edition\device_test.dll"2⤵
- Modifies registry class
PID:2452
-