062a86e044888afa8b04292440435ef71a8d127e71f5ddcc6837d8ecca7771e0

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14c7bcd6171699c61d15541c99524fbf.dll
Size

1.8MB
MD5

14c7bcd6171699c61d15541c99524fbf
SHA1

326f155972f468860d550d438a604d47818e5f25
SHA256

062a86e044888afa8b04292440435ef71a8d127e71f5ddcc6837d8ecca7771e0
SHA512

fae15f0e447afca4ab6128ca4064b8c514aaa435b885ba527ada0980628febc33bacabae34e40aebc9b65d3496018eee55d486ec93ebd519ed5c4dfbf97c44cd
SSDEEP

12288:vLXP7ROiQ7o6m4gkyImTgUz1M4BuMFiNVNGKr6BFdITTW21aRFS:bDRPQ/m4zftFMFidr6hc+g

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8874829-7DAF-46AA-A86F-2A5782547AF4}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2B9C83E5-C13D-4541-80BA-2C937D1E9436}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E4E04998-2CA2-499F-9C0A-71A77F114DD3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8874829-7DAF-46AA-A86F-2A5782547AF4}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\14c7bcd6171699c61d15541c99524fbf.dll,1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8874829-7DAF-46AA-A86F-2A5782547AF4}\Verb\0\ = "Properties,0,2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4E04998-2CA2-499F-9C0A-71A77F114DD3}\ = "IMscheldCx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{745726D1-72C3-440E-9DCD-51D971F79F20}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB8633BC-60C7-4EFC-846C-6535674CF17C}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4E04998-2CA2-499F-9C0A-71A77F114DD3}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ABA1518C-EA7B-4305-9037-E82611004444}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2B9C83E5-C13D-4541-80BA-2C937D1E9436}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4E04998-2CA2-499F-9C0A-71A77F114DD3}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{745726D1-72C3-440E-9DCD-51D971F79F20}\ = "IMscheldCxEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiveFormProj1.ActiveFormX\ = "ActiveFormX Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8874829-7DAF-46AA-A86F-2A5782547AF4}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B9C83E5-C13D-4541-80BA-2C937D1E9436}\TypeLib\ = "{ABA1518C-EA7B-4305-9037-E82611004444}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB8633BC-60C7-4EFC-846C-6535674CF17C}\TypeLib\ = "{ABA1518C-EA7B-4305-9037-E82611004444}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8874829-7DAF-46AA-A86F-2A5782547AF4}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8874829-7DAF-46AA-A86F-2A5782547AF4}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8874829-7DAF-46AA-A86F-2A5782547AF4}\Control\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2B9C83E5-C13D-4541-80BA-2C937D1E9436}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{745726D1-72C3-440E-9DCD-51D971F79F20}\TypeLib\ = "{ABA1518C-EA7B-4305-9037-E82611004444}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB8633BC-60C7-4EFC-846C-6535674CF17C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E4E04998-2CA2-499F-9C0A-71A77F114DD3}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4E04998-2CA2-499F-9C0A-71A77F114DD3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{745726D1-72C3-440E-9DCD-51D971F79F20}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8874829-7DAF-46AA-A86F-2A5782547AF4}\ProgID\ = "ActiveFormProj1.ActiveFormX"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8874829-7DAF-46AA-A86F-2A5782547AF4}\TypeLib\ = "{ABA1518C-EA7B-4305-9037-E82611004444}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B9C83E5-C13D-4541-80BA-2C937D1E9436}\ = "IActiveFormX"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B9C83E5-C13D-4541-80BA-2C937D1E9436}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{745726D1-72C3-440E-9DCD-51D971F79F20}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8874829-7DAF-46AA-A86F-2A5782547AF4}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB8633BC-60C7-4EFC-846C-6535674CF17C}\TypeLib\ = "{ABA1518C-EA7B-4305-9037-E82611004444}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{745726D1-72C3-440E-9DCD-51D971F79F20}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB8633BC-60C7-4EFC-846C-6535674CF17C}\ = "IActiveFormXEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB8633BC-60C7-4EFC-846C-6535674CF17C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E4E04998-2CA2-499F-9C0A-71A77F114DD3}\ = "IMscheldCx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{745726D1-72C3-440E-9DCD-51D971F79F20}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8874829-7DAF-46AA-A86F-2A5782547AF4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ABA1518C-EA7B-4305-9037-E82611004444}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB8633BC-60C7-4EFC-846C-6535674CF17C}\ = "IActiveFormXEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{745726D1-72C3-440E-9DCD-51D971F79F20}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB8633BC-60C7-4EFC-846C-6535674CF17C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E4E04998-2CA2-499F-9C0A-71A77F114DD3}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ABA1518C-EA7B-4305-9037-E82611004444}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\14c7bcd6171699c61d15541c99524fbf.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B9C83E5-C13D-4541-80BA-2C937D1E9436}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB8633BC-60C7-4EFC-846C-6535674CF17C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E4E04998-2CA2-499F-9C0A-71A77F114DD3}\TypeLib\ = "{ABA1518C-EA7B-4305-9037-E82611004444}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{745726D1-72C3-440E-9DCD-51D971F79F20}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8874829-7DAF-46AA-A86F-2A5782547AF4}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ABA1518C-EA7B-4305-9037-E82611004444}\1.0\ = "ActiveFormProj1 Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ABA1518C-EA7B-4305-9037-E82611004444}\1.0\FLAGS\ = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8874829-7DAF-46AA-A86F-2A5782547AF4}\Verb	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8874829-7DAF-46AA-A86F-2A5782547AF4}\ = "ActiveFormX Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8874829-7DAF-46AA-A86F-2A5782547AF4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\14c7bcd6171699c61d15541c99524fbf.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2B9C83E5-C13D-4541-80BA-2C937D1E9436}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4E04998-2CA2-499F-9C0A-71A77F114DD3}\TypeLib\ = "{ABA1518C-EA7B-4305-9037-E82611004444}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2B9C83E5-C13D-4541-80BA-2C937D1E9436}\TypeLib\ = "{ABA1518C-EA7B-4305-9037-E82611004444}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B9C83E5-C13D-4541-80BA-2C937D1E9436}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB8633BC-60C7-4EFC-846C-6535674CF17C}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4E04998-2CA2-499F-9C0A-71A77F114DD3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{745726D1-72C3-440E-9DCD-51D971F79F20}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8874829-7DAF-46AA-A86F-2A5782547AF4}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ABA1518C-EA7B-4305-9037-E82611004444}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2056	1488	regsvr32.exe	28
PID 1488 wrote to memory of 2056	1488	regsvr32.exe	28
PID 1488 wrote to memory of 2056	1488	regsvr32.exe	28
PID 1488 wrote to memory of 2056	1488	regsvr32.exe	28
PID 1488 wrote to memory of 2056	1488	regsvr32.exe	28
PID 1488 wrote to memory of 2056	1488	regsvr32.exe	28
PID 1488 wrote to memory of 2056	1488	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\14c7bcd6171699c61d15541c99524fbf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\14c7bcd6171699c61d15541c99524fbf.dll
  2⤵
  - Modifies registry class
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-0-0x00000000009F0000-0x0000000000BC2000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads