47a61c31155929b525dc5a39ad69922a2f3967c88559f47ba4fb0a48ea3f684b

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 12:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fujianjingling/GetUrl.dll
Size

24KB
MD5

67af3e22e6502049ab459206d71931f2
SHA1

704265db5c6b487def7580121ab217c48407608d
SHA256

a15f3c51d7f5afd2ddf0f4430d7f6b88906b68b92d8404c2ab5e3f4ae9e2774c
SHA512

b6a3fef81f24af599c72f1be0d359397aec0cddfea63b9fcec882f77e86fcefc5545f780745e074e88acbd48b4ecd7d22ad77bd5353fb68b2794e4232a72d6f8
SSDEEP

192:Rq8uOb30AYhoEbLIuW7DsAQAGeGzp4LC:Y8lYh5b8TDsASeGzqL

Score

1^/10

Malware Config

Signatures

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{204A8D7A-AB5A-4DB5-826C-9B1327597BE1}\TypeLib\ = "{1B098927-5B4E-482A-902E-FFFA84887D38}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{204A8D7A-AB5A-4DB5-826C-9B1327597BE1}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{204A8D7A-AB5A-4DB5-826C-9B1327597BE1}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66053530-4CFF-4C4F-B7A4-395B6FDB1B7C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1B098927-5B4E-482A-902E-FFFA84887D38}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1B098927-5B4E-482A-902E-FFFA84887D38}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fujianjingling\\GetUrl.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{204A8D7A-AB5A-4DB5-826C-9B1327597BE1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{204A8D7A-AB5A-4DB5-826C-9B1327597BE1}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66053530-4CFF-4C4F-B7A4-395B6FDB1B7C}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GetUrl.AddIEUrl\Clsid\ = "{66053530-4CFF-4C4F-B7A4-395B6FDB1B7C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{204A8D7A-AB5A-4DB5-826C-9B1327597BE1}\ = "AddIEUrl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66053530-4CFF-4C4F-B7A4-395B6FDB1B7C}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1B098927-5B4E-482A-902E-FFFA84887D38}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{204A8D7A-AB5A-4DB5-826C-9B1327597BE1}\ = "_AddIEUrl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66053530-4CFF-4C4F-B7A4-395B6FDB1B7C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GetUrl.AddIEUrl\ = "GetUrl.AddIEUrl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66053530-4CFF-4C4F-B7A4-395B6FDB1B7C}\VERSION	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1B098927-5B4E-482A-902E-FFFA84887D38}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fujianjingling"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{204A8D7A-AB5A-4DB5-826C-9B1327597BE1}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{204A8D7A-AB5A-4DB5-826C-9B1327597BE1}\TypeLib\ = "{1B098927-5B4E-482A-902E-FFFA84887D38}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66053530-4CFF-4C4F-B7A4-395B6FDB1B7C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fujianjingling\\GetUrl.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GetUrl.AddIEUrl\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1B098927-5B4E-482A-902E-FFFA84887D38}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1B098927-5B4E-482A-902E-FFFA84887D38}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{204A8D7A-AB5A-4DB5-826C-9B1327597BE1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66053530-4CFF-4C4F-B7A4-395B6FDB1B7C}\VERSION\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1B098927-5B4E-482A-902E-FFFA84887D38}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{204A8D7A-AB5A-4DB5-826C-9B1327597BE1}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66053530-4CFF-4C4F-B7A4-395B6FDB1B7C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66053530-4CFF-4C4F-B7A4-395B6FDB1B7C}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66053530-4CFF-4C4F-B7A4-395B6FDB1B7C}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66053530-4CFF-4C4F-B7A4-395B6FDB1B7C}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1B098927-5B4E-482A-902E-FFFA84887D38}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{204A8D7A-AB5A-4DB5-826C-9B1327597BE1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66053530-4CFF-4C4F-B7A4-395B6FDB1B7C}\ = "GetUrl.AddIEUrl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66053530-4CFF-4C4F-B7A4-395B6FDB1B7C}\ProgID\ = "GetUrl.AddIEUrl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{204A8D7A-AB5A-4DB5-826C-9B1327597BE1}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{204A8D7A-AB5A-4DB5-826C-9B1327597BE1}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1B098927-5B4E-482A-902E-FFFA84887D38}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1B098927-5B4E-482A-902E-FFFA84887D38}\1.0\ = "GetUrl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{204A8D7A-AB5A-4DB5-826C-9B1327597BE1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66053530-4CFF-4C4F-B7A4-395B6FDB1B7C}\TypeLib\ = "{1B098927-5B4E-482A-902E-FFFA84887D38}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{204A8D7A-AB5A-4DB5-826C-9B1327597BE1}\ = "_AddIEUrl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{204A8D7A-AB5A-4DB5-826C-9B1327597BE1}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GetUrl.AddIEUrl	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 436	2308	regsvr32.exe	14
PID 2308 wrote to memory of 436	2308	regsvr32.exe	14
PID 2308 wrote to memory of 436	2308	regsvr32.exe	14

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fujianjingling\GetUrl.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fujianjingling\GetUrl.dll
  2⤵
  - Modifies registry class
  PID:436

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads