bf200bf3542bd22b41d5ef1a8bf8ef77390e05abaee23aac48da1acd3dca4aff | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 02:33

Sharing

Report Analysis Logs

General

Target

0029d7dc9c00caf792ad9ae2b3518a1b.dll
Size

37KB
MD5

0029d7dc9c00caf792ad9ae2b3518a1b
SHA1

7f1c0502e6b05ff985e4ec284b3de5fcfae4891f
SHA256

bf200bf3542bd22b41d5ef1a8bf8ef77390e05abaee23aac48da1acd3dca4aff
SHA512

8ac58dd5245e6ce33efaf1d0132d66b477a426197b38653c514312da71a10ca1d9bd9674fb490ef94195a3d5e13e0dd72d14996e9c2f3f103ca7363a2bd5aaf1
SSDEEP

768:vPByKN84xZ36DSErHtkBwJOiV4dnzEwnYJ:HdNTOD5EwJ5sEmu

Score

1^/10

Malware Config

Signatures

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{df2e4f67-e93a-11d1-bb14-0000f8779051}\ = "netsflt Driver Configuration Notify Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}\1.0\ = "netsflt Notify 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{df2e4f67-e93a-11d1-bb14-0000f8779051}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0029d7dc9c00caf792ad9ae2b3518a1b.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{df2e4f67-e93a-11d1-bb14-0000f8779051}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{df2e4f67-e93a-11d1-bb14-0000f8779051}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{df2e4f67-e93a-11d1-bb14-0000f8779051}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0029D7~1.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38135D11-E93B-11D1-BB14-0000F8779051}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2508	2096	regsvr32.exe	28
PID 2096 wrote to memory of 2508	2096	regsvr32.exe	28
PID 2096 wrote to memory of 2508	2096	regsvr32.exe	28
PID 2096 wrote to memory of 2508	2096	regsvr32.exe	28
PID 2096 wrote to memory of 2508	2096	regsvr32.exe	28
PID 2096 wrote to memory of 2508	2096	regsvr32.exe	28
PID 2096 wrote to memory of 2508	2096	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0029d7dc9c00caf792ad9ae2b3518a1b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0029d7dc9c00caf792ad9ae2b3518a1b.dll
  2⤵
  - Modifies registry class
  PID:2508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2508-0-0x00000000000C0000-0x00000000000CC000-memory.dmp

Filesize
48KB

Download