9e4330c26a27910b5713211ae3bf5a93c20e00bedb60c0f63e773cebd48ec9c6

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

免费版/ninicom.dll
Size

188KB
MD5

2321163f6878a7ce7ebeb9995dcefdb4
SHA1

55531ce68b5e8c87df4e899ef664c27e7b4f1670
SHA256

b7b144b9c4ceac4c4afa26925354a7cf943972e8eacc764a88f87ad9b7072779
SHA512

4a3c663d8f96fb239a0be6fd2ff7e5f9684ef9ce6b14d81cdaa7111ba2337dc5bb9dc99617827a2c32844bb4ef048b0b1f89e8b0e63c2aa1b7847b69794e9e5b
SSDEEP

3072:HgGKxbWmJS8z/zUiV7+abZViI7SVdtb7nX2Dci+:HnebtHlVkr7XA

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComUtilities.UtilMan.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2E9178C0-D804-4A93-B55D-3FFF54B95FF1}\VersionIndependentProgID\ = "ComUtilities.ManagedAppBridge"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EF49428E-8C06-4412-8F64-1CF796F0BEDF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2E9178C0-D804-4A93-B55D-3FFF54B95FF1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D6B43A79-C0FC-4E85-8BB4-6235B81C6CBF}\ = "_IUtilManEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DD264321-7025-476C-8B7A-850E0B79DD41}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2639DA95-E95D-48B8-A379-083D2FA3E9BC}\ = "_IManagedAppBridgeEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EF49428E-8C06-4412-8F64-1CF796F0BEDF}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComUtilities.CustManageApp\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98EDB477-3064-4D0E-A09E-CC73F9AAB324}\ = "UtilMan Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98EDB477-3064-4D0E-A09E-CC73F9AAB324}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C43E6EBA-1999-4089-B9EF-EAC44D4ED625}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AD6E5643-7B0C-46AA-95AD-9773FF2A857A}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2E9178C0-D804-4A93-B55D-3FFF54B95FF1}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D6B43A79-C0FC-4E85-8BB4-6235B81C6CBF}\TypeLib\ = "{F8706742-6B5C-4E63-8DBD-9C79A14D2009}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2639DA95-E95D-48B8-A379-083D2FA3E9BC}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2E9178C0-D804-4A93-B55D-3FFF54B95FF1}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DD264321-7025-476C-8B7A-850E0B79DD41}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD264321-7025-476C-8B7A-850E0B79DD41}\TypeLib\ = "{F8706742-6B5C-4E63-8DBD-9C79A14D2009}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D6B43A79-C0FC-4E85-8BB4-6235B81C6CBF}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD264321-7025-476C-8B7A-850E0B79DD41}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EF49428E-8C06-4412-8F64-1CF796F0BEDF}\TypeLib\ = "{F8706742-6B5C-4E63-8DBD-9C79A14D2009}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComUtilities.CustManageApp\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98EDB477-3064-4D0E-A09E-CC73F9AAB324}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D6B43A79-C0FC-4E85-8BB4-6235B81C6CBF}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8706742-6B5C-4E63-8DBD-9C79A14D2009}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DD264321-7025-476C-8B7A-850E0B79DD41}\TypeLib\ = "{F8706742-6B5C-4E63-8DBD-9C79A14D2009}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD264321-7025-476C-8B7A-850E0B79DD41}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ComUtilities.UtilMan\CurVer\ = "ComUtilities.UtilMan.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98EDB477-3064-4D0E-A09E-CC73F9AAB324}\VersionIndependentProgID\ = "ComUtilities.UtilMan"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8706742-6B5C-4E63-8DBD-9C79A14D2009}\1.0\ = "ComUtilities 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD264321-7025-476C-8B7A-850E0B79DD41}\ = "IUtilMan"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2639DA95-E95D-48B8-A379-083D2FA3E9BC}\ = "_IManagedAppBridgeEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2639DA95-E95D-48B8-A379-083D2FA3E9BC}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EF49428E-8C06-4412-8F64-1CF796F0BEDF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AD6E5643-7B0C-46AA-95AD-9773FF2A857A}\ = "CustManageApp Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98EDB477-3064-4D0E-A09E-CC73F9AAB324}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8706742-6B5C-4E63-8DBD-9C79A14D2009}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2E9178C0-D804-4A93-B55D-3FFF54B95FF1}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8706742-6B5C-4E63-8DBD-9C79A14D2009}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2639DA95-E95D-48B8-A379-083D2FA3E9BC}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2639DA95-E95D-48B8-A379-083D2FA3E9BC}\TypeLib\ = "{F8706742-6B5C-4E63-8DBD-9C79A14D2009}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B6C355FD-215E-40A6-92C5-564619B1FA86}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AD6E5643-7B0C-46AA-95AD-9773FF2A857A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AD6E5643-7B0C-46AA-95AD-9773FF2A857A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98EDB477-3064-4D0E-A09E-CC73F9AAB324}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C43E6EBA-1999-4089-B9EF-EAC44D4ED625}\TypeLib\ = "{F8706742-6B5C-4E63-8DBD-9C79A14D2009}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2639DA95-E95D-48B8-A379-083D2FA3E9BC}\TypeLib\ = "{F8706742-6B5C-4E63-8DBD-9C79A14D2009}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C43E6EBA-1999-4089-B9EF-EAC44D4ED625}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComUtilities.UtilMan	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98EDB477-3064-4D0E-A09E-CC73F9AAB324}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2E9178C0-D804-4A93-B55D-3FFF54B95FF1}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EF49428E-8C06-4412-8F64-1CF796F0BEDF}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B6C355FD-215E-40A6-92C5-564619B1FA86}\TypeLib\ = "{F8706742-6B5C-4E63-8DBD-9C79A14D2009}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B6C355FD-215E-40A6-92C5-564619B1FA86}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C43E6EBA-1999-4089-B9EF-EAC44D4ED625}\TypeLib\ = "{F8706742-6B5C-4E63-8DBD-9C79A14D2009}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AD6E5643-7B0C-46AA-95AD-9773FF2A857A}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComUtilities.ManagedAppBridge	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2E9178C0-D804-4A93-B55D-3FFF54B95FF1}\ProgID\ = "ComUtilities.ManagedAppBridge.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98EDB477-3064-4D0E-A09E-CC73F9AAB324}\TypeLib\ = "{F8706742-6B5C-4E63-8DBD-9C79A14D2009}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D6B43A79-C0FC-4E85-8BB4-6235B81C6CBF}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ComUtilities.CustManageApp\ = "CustManageApp Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AD6E5643-7B0C-46AA-95AD-9773FF2A857A}\VersionIndependentProgID\ = "ComUtilities.CustManageApp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ComUtilities.UtilMan.1\CLSID\ = "{98EDB477-3064-4D0E-A09E-CC73F9AAB324}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 840	2020	regsvr32.exe	28
PID 2020 wrote to memory of 840	2020	regsvr32.exe	28
PID 2020 wrote to memory of 840	2020	regsvr32.exe	28
PID 2020 wrote to memory of 840	2020	regsvr32.exe	28
PID 2020 wrote to memory of 840	2020	regsvr32.exe	28
PID 2020 wrote to memory of 840	2020	regsvr32.exe	28
PID 2020 wrote to memory of 840	2020	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\免费版\ninicom.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\免费版\ninicom.dll
  2⤵
  - Modifies registry class
  PID:840

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads