d82aadd3332d5302851bff734bf5c07d01265a2630a66fe959fb894964cb2d4f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MSHFLXGD.dll
Size

428KB
MD5

f7814c0ae99fa399dfa33c4490a7cca1
SHA1

f8dc93765f0d4e04a7cab852a5cf0626d6f4f6df
SHA256

983a465b0e38870ea875f59575570ea14ddaac3d95c867279c9a44690ad4b379
SHA512

562625c59583f8528a1e8744ca659a7f3adbe69e52ebf771f6c450b0d84411809c3700433be6b5354ba0014f8134d67246627c42ce5f86851b606edf5aed16b8
SSDEEP

6144:fluMQ6F6RWIT4usbHlxq/ZBeYTMFtXgbqb/GXvQ7zjxSgYrSVAFsCTjamfnSvER6:9ujSlxgmgbqbcQ/jxSgYWVAFsC3am4H

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSHierarchicalFlexGridLib.MSHFlexGrid.6\CLSID\ = "{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}\6.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSHierarchicalFlexGridLib.MSHFlexGrid\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB36A920-23A5-11D0-B351-00A0C9055D8E}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\ = "{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0ECD9B62-23AA-11D0-B351-00A0C9055D8E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB36A921-805A-11CF-91F7-C2863C385E30}\ = "MS Hierarchical FlexGrid Style Property Page Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0ECD9B62-23AA-11D0-B351-00A0C9055D8E}\TypeLib\Version = "6.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSHierarchicalFlexGridLib.MSHFlexGrid.6\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSHFLXGD.dll, 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}\6.0\FLAGS\ = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}\6.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}\6.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSHFLXGD.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "6.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB36A921-805A-11CF-91F7-C2863C385E30}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ECD9B62-23AA-11D0-B351-00A0C9055D8E}\ = "IMSHFlexGrid"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}\6.0\HELPDIR\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "6.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSHierarchicalFlexGridLib.MSHFlexGrid.6	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\ = "{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ECD9B62-23AA-11D0-B351-00A0C9055D8E}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\TypeLib\ = "{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB36A920-23A5-11D0-B351-00A0C9055D8E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSHFLXGD.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSHierarchicalFlexGridLib.MSHFlexGrid\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{951738D1-D2B7-11D0-B292-00A0C908FB55}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\ = "{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\ = "DMSHFlexGridEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSHierarchicalFlexGridLib.MSHFlexGrid.6\ = "Microsoft Hierarchical FlexGrid Control, Version 6.0 (OLEDB)"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ = "IVBDataObject"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ECD9B62-23AA-11D0-B351-00A0C9055D8E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSHFLXGD.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0ECD9B62-23AA-11D0-B351-00A0C9055D8E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0ECD9B62-23AA-11D0-B351-00A0C9055D8E}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\TypeLib\ = "{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSHierarchicalFlexGridLib.MSHFlexGrid\CLSID\ = "{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB36A920-23A5-11D0-B351-00A0C9055D8E}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{951738D1-D2B7-11D0-B292-00A0C908FB55}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSHFLXGD.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}\6.0\ = "Microsoft Hierarchical FlexGrid Control 6.0 (SP3) (OLEDB)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ECD9B62-23AA-11D0-B351-00A0C9055D8E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ = "IVBDataObjectFiles"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0ECD9B62-23AA-11D0-B351-00A0C9055D8E}\TypeLib\ = "{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\ = "DMSHFlexGridEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ECD9B62-23AA-11D0-B351-00A0C9055D8E}\TypeLib\ = "{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1192 wrote to memory of 1796	1192	regsvr32.exe	regsvr32.exe
PID 1192 wrote to memory of 1796	1192	regsvr32.exe	regsvr32.exe
PID 1192 wrote to memory of 1796	1192	regsvr32.exe	regsvr32.exe
PID 1192 wrote to memory of 1796	1192	regsvr32.exe	regsvr32.exe
PID 1192 wrote to memory of 1796	1192	regsvr32.exe	regsvr32.exe
PID 1192 wrote to memory of 1796	1192	regsvr32.exe	regsvr32.exe
PID 1192 wrote to memory of 1796	1192	regsvr32.exe	regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\MSHFLXGD.dll
1⤵
- Modifies registry class
PID:1796

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\MSHFLXGD.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1192

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads