d0d0b026cdfe99d9589f6cf3223731e9420a4bab6d5e0e7ead4ccf93cdf2045c

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ccd9206d0c4eddee2f409bd3733e7ff.dll
Size

248KB
MD5

3ccd9206d0c4eddee2f409bd3733e7ff
SHA1

36726dda5cc1d046692feecccf7fc00d8ea1c93d
SHA256

d0d0b026cdfe99d9589f6cf3223731e9420a4bab6d5e0e7ead4ccf93cdf2045c
SHA512

9543728f283634c131296d4b48c8cc07ca09f38f7ef9fd849344b87e065324f8a53ef453ecf2a54bd1b1243c1b6eff9891c93f68a49358e9917a567b133d313d
SSDEEP

3072:bHbeL0i42nSpuD/heke1AKy7e4GtbA6gh4i1ABEzFmFJyEyU10JjvUlInZjhCJ9K:TOQ2LD/69Rr44kABEQhytjBZlKIM1Y

Score

1^/10

Malware Config

Signatures

Modifies registry class 55 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E18C3DAF-9841-4340-AFE9-27AB400650AB}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E48C3DAF-9841-4345-AFE9-27AB400650AB}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\Version\ = "1.0"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\Elevation\Enabled = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E48C3DAF-9841-4345-AFE9-27AB400650AB}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bho.bho\Clsid\ = "{616D534C-3CA8-43AB-B439-618F850F1D2B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\3ccd9206d0c4eddee2f409bd3733e7ff.dll	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E18C3DAF-9841-4340-AFE9-27AB400650AB}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\AppID = "{616D534C-3CA8-43AB-B439-618F850F1D2B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E18C3DAF-9841-4340-AFE9-27AB400650AB}\TypeLib\ = "{E48C3DAF-9841-4345-AFE9-27AB400650AB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E48C3DAF-9841-4345-AFE9-27AB400650AB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3ccd9206d0c4eddee2f409bd3733e7ff.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E18C3DAF-9841-4340-AFE9-27AB400650AB}\ = "IntfVideo"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E48C3DAF-9841-4345-AFE9-27AB400650AB}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E18C3DAF-9841-4340-AFE9-27AB400650AB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E18C3DAF-9841-4340-AFE9-27AB400650AB}\TypeLib\ = "{E48C3DAF-9841-4345-AFE9-27AB400650AB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E18C3DAF-9841-4340-AFE9-27AB400650AB}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bho.bho\ = "IE"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\LocalizedString = "@C:\\Users\\Admin\\AppData\\Local\\Temp\\3ccd9206d0c4eddee2f409bd3733e7ff.dll,-313"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E48C3DAF-9841-4345-AFE9-27AB400650AB}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E18C3DAF-9841-4340-AFE9-27AB400650AB}\ = "IntfVideo"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{616D534C-3CA8-43AB-B439-618F850F1D2B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\ = "IE"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{616D534C-3CA8-43AB-B439-618F850F1D2B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\DllSurrogate	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E18C3DAF-9841-4340-AFE9-27AB400650AB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E18C3DAF-9841-4340-AFE9-27AB400650AB}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bho.bho	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E48C3DAF-9841-4345-AFE9-27AB400650AB}\1.0\ = "IE"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\AccessPermission = 01000480440000005400000000000000140000000200300002000000000014000300000001010000000000050400000000001400030000000101000000000005120000000102000000000005200000002002000001020000000000052000000020020000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E18C3DAF-9841-4340-AFE9-27AB400650AB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E48C3DAF-9841-4345-AFE9-27AB400650AB}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3ccd9206d0c4eddee2f409bd3733e7ff.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E18C3DAF-9841-4340-AFE9-27AB400650AB}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E48C3DAF-9841-4345-AFE9-27AB400650AB}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\TypeLib\ = "{E48C3DAF-9841-4345-AFE9-27AB400650AB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\Elevation	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\ProgID\ = "bho.bho"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E18C3DAF-9841-4340-AFE9-27AB400650AB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bho.bho\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{616D534C-3CA8-43AB-B439-618F850F1D2B}\ = "IE"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\3ccd9206d0c4eddee2f409bd3733e7ff.dll\AppID = "{616D534C-3CA8-43AB-B439-618F850F1D2B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E48C3DAF-9841-4345-AFE9-27AB400650AB}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E18C3DAF-9841-4340-AFE9-27AB400650AB}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E48C3DAF-9841-4345-AFE9-27AB400650AB}\1.0\FLAGS\ = "0"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 3884	4796	regsvr32.exe	89
PID 4796 wrote to memory of 3884	4796	regsvr32.exe	89
PID 4796 wrote to memory of 3884	4796	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3ccd9206d0c4eddee2f409bd3733e7ff.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3ccd9206d0c4eddee2f409bd3733e7ff.dll
  2⤵
  - Modifies registry class
  PID:3884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3884-0-0x00000000021E0000-0x00000000022C9000-memory.dmp

Filesize
932KB

Download
memory/3884-1-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads