97ac888efe98ca5bfaa36c2ea420cb612fae5cc2d4b8acc859c728347db0d01f

Analysis

max time kernel
123s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QuickWAP.dll
Size

1.5MB
MD5

a78b92c2a9eebd0d24c91934388b8d0e
SHA1

e9e9193c3a34e06e373ab621aa76c601dc422d23
SHA256

32581120d0acfe4bd20348963507fc39f5d285e603cfa9a09e5c519ec6b641de
SHA512

8896d67adb45fa938d2d97a8ab9f4f57f7e4335df2ff567659f72c9072e83e22290f1a133f0b3ac459bda7efd68cd1767f507a27bef321d06269a27341b927de
SSDEEP

24576:FdRYt9sWX33NYdBmW6iVyty93AD5RqS5s:eXCVsty9iG

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3CC48953-295E-460A-B0C1-0ACB3420D434}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{18E89994-E726-4C04-BF81-8BB6C1409EAE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F5FCF5D-2963-4E07-AA04-60437F3C1987}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27BF1A2C-78C4-44F0-8A64-6DF7AB551357}\VERSION\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF49A5FA-2030-428A-B52D-B71623A70C25}\ = "QuickWAP.EnWAP"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickWAP.WAP\Clsid\ = "{80C43B8A-332C-4E17-BD80-4299CEF40156}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A6823869-2D90-4362-B79B-10D7F9D608A3}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06CC0448-BE64-4D55-A49E-9ACAA575E6DC}\VERSION\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3F445551-B911-42A9-B153-300C1ECEE0A6}\ = "_WAPWML"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEF0D832-BBAB-497B-A255-967D216BAAF0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F065EAB5-A35C-457B-BA30-9ACB12219724}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickWAP.Common	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C757F606-1627-4408-AD26-892C938D2DAD}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3F445551-B911-42A9-B153-300C1ECEE0A6}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{659CFEEE-2C12-490D-9142-849048999BF5}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A159049C-3C71-4D76-B236-0FFC57600B85}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A6823869-2D90-4362-B79B-10D7F9D608A3}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{36099687-5D3A-4648-A3E0-398267862FF0}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E98E867-44E3-4EB4-9DC6-4FC27243AF52}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C757F606-1627-4408-AD26-892C938D2DAD}\TypeLib\ = "{659CFEEE-2C12-490D-9142-849048999BF5}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F065EAB5-A35C-457B-BA30-9ACB12219724}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06CC0448-BE64-4D55-A49E-9ACAA575E6DC}\ProgID\ = "QuickWAP.XML"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E98E867-44E3-4EB4-9DC6-4FC27243AF52}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F065EAB5-A35C-457B-BA30-9ACB12219724}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7D16D7AC-1C4D-4919-AD78-311F147199B8}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7D16D7AC-1C4D-4919-AD78-311F147199B8}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A6823869-2D90-4362-B79B-10D7F9D608A3}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27BF1A2C-78C4-44F0-8A64-6DF7AB551357}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06CC0448-BE64-4D55-A49E-9ACAA575E6DC}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{659CFEEE-2C12-490D-9142-849048999BF5}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C757F606-1627-4408-AD26-892C938D2DAD}\TypeLib\ = "{659CFEEE-2C12-490D-9142-849048999BF5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F5FCF5D-2963-4E07-AA04-60437F3C1987}\ = "QuickWAP.WAPWML"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27BF1A2C-78C4-44F0-8A64-6DF7AB551357}\ProgID\ = "QuickWAP.Common"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF49A5FA-2030-428A-B52D-B71623A70C25}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E98E867-44E3-4EB4-9DC6-4FC27243AF52}\ = "EnXML"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F445551-B911-42A9-B153-300C1ECEE0A6}\TypeLib\ = "{659CFEEE-2C12-490D-9142-849048999BF5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C757F606-1627-4408-AD26-892C938D2DAD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27BF1A2C-78C4-44F0-8A64-6DF7AB551357}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6823869-2D90-4362-B79B-10D7F9D608A3}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickWAP.WAPWML\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80C43B8A-332C-4E17-BD80-4299CEF40156}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A159049C-3C71-4D76-B236-0FFC57600B85}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FEF0D832-BBAB-497B-A255-967D216BAAF0}\ = "_PHPXML"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickWAP.WAPWML\ = "QuickWAP.WAPWML"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A159049C-3C71-4D76-B236-0FFC57600B85}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E98E867-44E3-4EB4-9DC6-4FC27243AF52}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{18E89994-E726-4C04-BF81-8BB6C1409EAE}\ = "_EnWAP"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18E89994-E726-4C04-BF81-8BB6C1409EAE}\ = "_EnWAP"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06CC0448-BE64-4D55-A49E-9ACAA575E6DC}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27BF1A2C-78C4-44F0-8A64-6DF7AB551357}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QuickWAP.EnXML	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{659CFEEE-2C12-490D-9142-849048999BF5}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E98E867-44E3-4EB4-9DC6-4FC27243AF52}\ = "_EnXML"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F065EAB5-A35C-457B-BA30-9ACB12219724}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80C43B8A-332C-4E17-BD80-4299CEF40156}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A159049C-3C71-4D76-B236-0FFC57600B85}\ = "_WAP"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18E89994-E726-4C04-BF81-8BB6C1409EAE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F445551-B911-42A9-B153-300C1ECEE0A6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF49A5FA-2030-428A-B52D-B71623A70C25}\ProgID\ = "QuickWAP.EnWAP"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{659CFEEE-2C12-490D-9142-849048999BF5}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E98E867-44E3-4EB4-9DC6-4FC27243AF52}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27BF1A2C-78C4-44F0-8A64-6DF7AB551357}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF49A5FA-2030-428A-B52D-B71623A70C25}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F065EAB5-A35C-457B-BA30-9ACB12219724}\ProgID\ = "QuickWAP.PHPXML"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2156	2512	regsvr32.exe	17
PID 2512 wrote to memory of 2156	2512	regsvr32.exe	17
PID 2512 wrote to memory of 2156	2512	regsvr32.exe	17
PID 2512 wrote to memory of 2156	2512	regsvr32.exe	17
PID 2512 wrote to memory of 2156	2512	regsvr32.exe	17
PID 2512 wrote to memory of 2156	2512	regsvr32.exe	17
PID 2512 wrote to memory of 2156	2512	regsvr32.exe	17

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\QuickWAP.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\QuickWAP.dll
  2⤵
  - Modifies registry class
  PID:2156

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads