60d785b14ec039a3778a03c544787516d6fdc84f751a8e73ae46222c3b96ee91

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3f116fa216985d7328d074e4991f4a69.dll
Size

360KB
MD5

3f116fa216985d7328d074e4991f4a69
SHA1

1081a4898fa93a87caf8a4dfd4aa2fad873f61eb
SHA256

60d785b14ec039a3778a03c544787516d6fdc84f751a8e73ae46222c3b96ee91
SHA512

8db1c2d85597919f7fd4e3aedfd341910297f3f12d52537a0c44306813ed08d58011ed1e66624c0638c055bcc93dda1c943f0a35a9696dedb2fe64abf6f35c55
SSDEEP

6144:IEFqXRhcYiFZ8B3TkZvc2kSTe0WQ6qxUmX6:bnFZ8MjkGeZVqxU

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{56FF91CE-BE51-46B1-ACA0-CE436A01CD12}\ = "_Damwl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56FF91CE-BE51-46B1-ACA0-CE436A01CD12}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VAC.Video\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{459476FD-1BB1-4756-8CA9-8BA09017EE6A}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{459476FD-1BB1-4756-8CA9-8BA09017EE6A}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{754D2D58-392E-4C9C-8287-B196AB3F5633}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{754D2D58-392E-4C9C-8287-B196AB3F5633}\1.0\ = "ActiveX Control module"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56FF91CE-BE51-46B1-ACA0-CE436A01CD12}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{754D2D58-392E-4C9C-8287-B196AB3F5633}\1.0\FLAGS\ = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{56FF91CE-BE51-46B1-ACA0-CE436A01CD12}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4E5B3B0-F97E-4EA6-B59C-2886FA8B8C33}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C50F2982-D9F6-47BD-B5C4-B2A98C68C406}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{459476FD-1BB1-4756-8CA9-8BA09017EE6A}\ProgID\ = "VAC.Video"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{754D2D58-392E-4C9C-8287-B196AB3F5633}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C50F2982-D9F6-47BD-B5C4-B2A98C68C406}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{56FF91CE-BE51-46B1-ACA0-CE436A01CD12}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56FF91CE-BE51-46B1-ACA0-CE436A01CD12}\TypeLib\ = "{754D2D58-392E-4C9C-8287-B196AB3F5633}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{459476FD-1BB1-4756-8CA9-8BA09017EE6A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{459476FD-1BB1-4756-8CA9-8BA09017EE6A}\ = "amwl Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{459476FD-1BB1-4756-8CA9-8BA09017EE6A}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{56FF91CE-BE51-46B1-ACA0-CE436A01CD12}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4E5B3B0-F97E-4EA6-B59C-2886FA8B8C33}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C50F2982-D9F6-47BD-B5C4-B2A98C68C406}\ = "amwl Property Page"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{459476FD-1BB1-4756-8CA9-8BA09017EE6A}\Control\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{754D2D58-392E-4C9C-8287-B196AB3F5633}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4E5B3B0-F97E-4EA6-B59C-2886FA8B8C33}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{754D2D58-392E-4C9C-8287-B196AB3F5633}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{56FF91CE-BE51-46B1-ACA0-CE436A01CD12}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4E5B3B0-F97E-4EA6-B59C-2886FA8B8C33}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4E5B3B0-F97E-4EA6-B59C-2886FA8B8C33}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VAC.Video	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{459476FD-1BB1-4756-8CA9-8BA09017EE6A}\MiscStatus\1\ = "132241"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56FF91CE-BE51-46B1-ACA0-CE436A01CD12}\ = "_Damwl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4E5B3B0-F97E-4EA6-B59C-2886FA8B8C33}\ = "_DamwlEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4E5B3B0-F97E-4EA6-B59C-2886FA8B8C33}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4E5B3B0-F97E-4EA6-B59C-2886FA8B8C33}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4E5B3B0-F97E-4EA6-B59C-2886FA8B8C33}\TypeLib\ = "{754D2D58-392E-4C9C-8287-B196AB3F5633}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{56FF91CE-BE51-46B1-ACA0-CE436A01CD12}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56FF91CE-BE51-46B1-ACA0-CE436A01CD12}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4E5B3B0-F97E-4EA6-B59C-2886FA8B8C33}\TypeLib\ = "{754D2D58-392E-4C9C-8287-B196AB3F5633}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{459476FD-1BB1-4756-8CA9-8BA09017EE6A}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{754D2D58-392E-4C9C-8287-B196AB3F5633}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3f116fa216985d7328d074e4991f4a69.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4E5B3B0-F97E-4EA6-B59C-2886FA8B8C33}\ = "_DamwlEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4E5B3B0-F97E-4EA6-B59C-2886FA8B8C33}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C50F2982-D9F6-47BD-B5C4-B2A98C68C406}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3F116F~1.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VAC.Video\ = "amwl Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{459476FD-1BB1-4756-8CA9-8BA09017EE6A}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{459476FD-1BB1-4756-8CA9-8BA09017EE6A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3F116F~1.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{459476FD-1BB1-4756-8CA9-8BA09017EE6A}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{754D2D58-392E-4C9C-8287-B196AB3F5633}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56FF91CE-BE51-46B1-ACA0-CE436A01CD12}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VAC.Video\CLSID\ = "{459476FD-1BB1-4756-8CA9-8BA09017EE6A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{459476FD-1BB1-4756-8CA9-8BA09017EE6A}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{459476FD-1BB1-4756-8CA9-8BA09017EE6A}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{56FF91CE-BE51-46B1-ACA0-CE436A01CD12}\TypeLib\ = "{754D2D58-392E-4C9C-8287-B196AB3F5633}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4E5B3B0-F97E-4EA6-B59C-2886FA8B8C33}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{459476FD-1BB1-4756-8CA9-8BA09017EE6A}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{754D2D58-392E-4C9C-8287-B196AB3F5633}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56FF91CE-BE51-46B1-ACA0-CE436A01CD12}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4E5B3B0-F97E-4EA6-B59C-2886FA8B8C33}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{459476FD-1BB1-4756-8CA9-8BA09017EE6A}\TypeLib\ = "{754D2D58-392E-4C9C-8287-B196AB3F5633}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2136	3000	regsvr32.exe	28
PID 3000 wrote to memory of 2136	3000	regsvr32.exe	28
PID 3000 wrote to memory of 2136	3000	regsvr32.exe	28
PID 3000 wrote to memory of 2136	3000	regsvr32.exe	28
PID 3000 wrote to memory of 2136	3000	regsvr32.exe	28
PID 3000 wrote to memory of 2136	3000	regsvr32.exe	28
PID 3000 wrote to memory of 2136	3000	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3f116fa216985d7328d074e4991f4a69.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3f116fa216985d7328d074e4991f4a69.dll
  2⤵
  - Modifies registry class
  PID:2136

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads