d82aadd3332d5302851bff734bf5c07d01265a2630a66fe959fb894964cb2d4f

Analysis

max time kernel
124s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MSHFLXGD.dll
Size

428KB
MD5

f7814c0ae99fa399dfa33c4490a7cca1
SHA1

f8dc93765f0d4e04a7cab852a5cf0626d6f4f6df
SHA256

983a465b0e38870ea875f59575570ea14ddaac3d95c867279c9a44690ad4b379
SHA512

562625c59583f8528a1e8744ca659a7f3adbe69e52ebf771f6c450b0d84411809c3700433be6b5354ba0014f8134d67246627c42ce5f86851b606edf5aed16b8
SSDEEP

6144:fluMQ6F6RWIT4usbHlxq/ZBeYTMFtXgbqb/GXvQ7zjxSgYrSVAFsCTjamfnSvER6:9ujSlxgmgbqbcQ/jxSgYWVAFsC3am4H

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB36A920-23A5-11D0-B351-00A0C9055D8E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ = "IVBDataObjectFiles"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ = "IVBDataObjectFiles"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0ECD9B62-23AA-11D0-B351-00A0C9055D8E}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSHierarchicalFlexGridLib.MSHFlexGrid\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB36A921-805A-11CF-91F7-C2863C385E30}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ECD9B62-23AA-11D0-B351-00A0C9055D8E}\TypeLib\Version = "6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSHierarchicalFlexGridLib.MSHFlexGrid	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB36A921-805A-11CF-91F7-C2863C385E30}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\TypeLib\ = "{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSHFLXGD.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0ECD9B62-23AA-11D0-B351-00A0C9055D8E}\TypeLib\ = "{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB36A921-805A-11CF-91F7-C2863C385E30}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0ECD9B62-23AA-11D0-B351-00A0C9055D8E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\TypeLib\Version = "6.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSHierarchicalFlexGridLib.MSHFlexGrid\CLSID\ = "{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0ECD9B62-23AA-11D0-B351-00A0C9055D8E}\ = "IMSHFlexGrid"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\ = "{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}\6.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ = "IVBDataObject"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{951738D1-D2B7-11D0-B292-00A0C908FB55}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\TypeLib\Version = "6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}\6.0\FLAGS\ = "2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}\6.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSHFLXGD.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB36A920-23A5-11D0-B351-00A0C9055D8E}\ = "MS Hierarchical FlexGrid General Property Page Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ECD9B62-23AA-11D0-B351-00A0C9055D8E}\TypeLib\ = "{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSHierarchicalFlexGridLib.MSHFlexGrid\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{951738D1-D2B7-11D0-B292-00A0C908FB55}\ = "MS Hierarchical FlexGrid Bands Property Page Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\ = "DMSHFlexGridEvents"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB36A920-23A5-11D0-B351-00A0C9055D8E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB36A920-23A5-11D0-B351-00A0C9055D8E}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}\6.0\HELPDIR\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\ = "DMSHFlexGridEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0ECD9B63-23AA-11D0-B351-00A0C9055D8E}\TypeLib\ = "{0ECD9B60-23AA-11D0-B351-00A0C9055D8E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\VersionIndependentProgID	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2484 wrote to memory of 2376	2484	regsvr32.exe	regsvr32.exe
PID 2484 wrote to memory of 2376	2484	regsvr32.exe	regsvr32.exe
PID 2484 wrote to memory of 2376	2484	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\MSHFLXGD.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\MSHFLXGD.dll
  2⤵
  - Modifies registry class
  PID:2376

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads