7de34b228cc9adbba044a0a12c86e025e590f667e886f2f94c7d21c159b3b314 | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 17:28

Sharing

Report Analysis Logs

General

Target

VM31BPRP.dll
Size

156KB
MD5

c93d4d89e40288d54edac2a9e8bd771a
SHA1

d3edcd8402873313e45a1f7c1c3e860325cebe35
SHA256

6607fa2e606b4b42bb8a1d16b3ad2551258156366986e8279e5b65f365a2680c
SHA512

19d07b216d6ac898f68ddbc0f5bf1726d6f0d5ebbc2a8e039617aa83bfead27d455271a1deb475f86c41467c027266553e3a295c090f3e8e3fc1166cd9eac6f6
SSDEEP

1536:G3NSRZ+dYCBCugD5BJdta9eZEdKdVHCEp0NxnAn3r:m905BdjZ0uVHjpexnAnb

Score

1^/10

Malware Config

Signatures

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C757C51-8D95-453C-8284-906A68DC53FA}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C757C52-8D95-453C-8284-906A68DC53FA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C757C51-8D95-453C-8284-906A68DC53FA}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VM31BPRP.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C757C51-8D95-453C-8284-906A68DC53FA}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C757C52-8D95-453C-8284-906A68DC53FA}\ = "ZSMC BackDoor Property Page"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C757C52-8D95-453C-8284-906A68DC53FA}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C757C52-8D95-453C-8284-906A68DC53FA}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VM31BPRP.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C757C5A-8D95-453C-8284-906A68DC53FA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C757C5A-8D95-453C-8284-906A68DC53FA}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C757C5A-8D95-453C-8284-906A68DC53FA}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C757C51-8D95-453C-8284-906A68DC53FA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C757C5A-8D95-453C-8284-906A68DC53FA}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C757C5A-8D95-453C-8284-906A68DC53FA}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VM31BPRP.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C757C51-8D95-453C-8284-906A68DC53FA}\ = "ZSMC Custom Property Page"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C757C52-8D95-453C-8284-906A68DC53FA}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2276	2100	regsvr32.exe	28
PID 2100 wrote to memory of 2276	2100	regsvr32.exe	28
PID 2100 wrote to memory of 2276	2100	regsvr32.exe	28
PID 2100 wrote to memory of 2276	2100	regsvr32.exe	28
PID 2100 wrote to memory of 2276	2100	regsvr32.exe	28
PID 2100 wrote to memory of 2276	2100	regsvr32.exe	28
PID 2100 wrote to memory of 2276	2100	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\VM31BPRP.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\VM31BPRP.dll
  2⤵
  - Modifies registry class
  PID:2276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads