d944c4661a687f976be4d48237661002711e5ec1f41b591438a3da0c5d2ddc18

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 13:40 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74d5a4ce54ae8ceff5f28bb9f20dd60f.dll
Size

40KB
MD5

74d5a4ce54ae8ceff5f28bb9f20dd60f
SHA1

af5fc283160087076fccf84c12898f2c1e68338b
SHA256

d944c4661a687f976be4d48237661002711e5ec1f41b591438a3da0c5d2ddc18
SHA512

0028a5ad3d6aa15b1e97f1b70949612064d06d3e006d86dcad953e57405fbfefb1c6d4919f5910c34d0f3b3b24e4c080b1d4bcbb4c581749e2be99f6458ffcd5
SSDEEP

384:gRBPspDBmFRUcLAv4aw2JYdemNvmjfHggNkomWLLQHlFA:QBUpdmFCf4FVdj9mjVNkvWLw

Score

1^/10

Malware Config

Signatures

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BF63D86F-966F-4A55-9271-0DDA8DC413D7}\9.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C179400-BBD6-4D98-B0BD-4712B1B3A3A0}\ = "_GbiehCef"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GbiehObj.GbiehCef	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GbiehObj.GbiehCef\ = "GbiehObj.GbiehCef"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BF63D86F-966F-4A55-9271-0DDA8DC413D7}\9.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C179400-BBD6-4D98-B0BD-4712B1B3A3A0}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B0525296-9E1F-4148-8828-60B78A8CC7E9}\ = "GbiehObj.GbiehCef"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B0525296-9E1F-4148-8828-60B78A8CC7E9}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B0525296-9E1F-4148-8828-60B78A8CC7E9}\ProgID\ = "GbiehObj.GbiehCef"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B0525296-9E1F-4148-8828-60B78A8CC7E9}\TypeLib\ = "{BF63D86F-966F-4A55-9271-0DDA8DC413D7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GbiehObj.GbiehCef\Clsid\ = "{B0525296-9E1F-4148-8828-60B78A8CC7E9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C179400-BBD6-4D98-B0BD-4712B1B3A3A0}\ = "GbiehCef"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C179400-BBD6-4D98-B0BD-4712B1B3A3A0}\TypeLib\Version = "9.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B0525296-9E1F-4148-8828-60B78A8CC7E9}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C179400-BBD6-4D98-B0BD-4712B1B3A3A0}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BF63D86F-966F-4A55-9271-0DDA8DC413D7}\9.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C179400-BBD6-4D98-B0BD-4712B1B3A3A0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C179400-BBD6-4D98-B0BD-4712B1B3A3A0}\TypeLib\Version = "9.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B0525296-9E1F-4148-8828-60B78A8CC7E9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\74d5a4ce54ae8ceff5f28bb9f20dd60f.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B0525296-9E1F-4148-8828-60B78A8CC7E9}\VERSION	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B0525296-9E1F-4148-8828-60B78A8CC7E9}\VERSION\ = "9.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BF63D86F-966F-4A55-9271-0DDA8DC413D7}\9.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C179400-BBD6-4D98-B0BD-4712B1B3A3A0}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B0525296-9E1F-4148-8828-60B78A8CC7E9}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B0525296-9E1F-4148-8828-60B78A8CC7E9}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C179400-BBD6-4D98-B0BD-4712B1B3A3A0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C179400-BBD6-4D98-B0BD-4712B1B3A3A0}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B0525296-9E1F-4148-8828-60B78A8CC7E9}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B0525296-9E1F-4148-8828-60B78A8CC7E9}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BF63D86F-966F-4A55-9271-0DDA8DC413D7}\9.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B0525296-9E1F-4148-8828-60B78A8CC7E9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C179400-BBD6-4D98-B0BD-4712B1B3A3A0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BF63D86F-966F-4A55-9271-0DDA8DC413D7}\9.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BF63D86F-966F-4A55-9271-0DDA8DC413D7}\9.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\74d5a4ce54ae8ceff5f28bb9f20dd60f.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C179400-BBD6-4D98-B0BD-4712B1B3A3A0}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C179400-BBD6-4D98-B0BD-4712B1B3A3A0}\ = "_GbiehCef"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C179400-BBD6-4D98-B0BD-4712B1B3A3A0}\TypeLib\ = "{BF63D86F-966F-4A55-9271-0DDA8DC413D7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BF63D86F-966F-4A55-9271-0DDA8DC413D7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BF63D86F-966F-4A55-9271-0DDA8DC413D7}\9.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C179400-BBD6-4D98-B0BD-4712B1B3A3A0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C179400-BBD6-4D98-B0BD-4712B1B3A3A0}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C179400-BBD6-4D98-B0BD-4712B1B3A3A0}\TypeLib\ = "{BF63D86F-966F-4A55-9271-0DDA8DC413D7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B0525296-9E1F-4148-8828-60B78A8CC7E9}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GbiehObj.GbiehCef\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BF63D86F-966F-4A55-9271-0DDA8DC413D7}\9.0\ = "GbiehObj"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1752	3028	regsvr32.exe	17
PID 3028 wrote to memory of 1752	3028	regsvr32.exe	17
PID 3028 wrote to memory of 1752	3028	regsvr32.exe	17
PID 3028 wrote to memory of 1752	3028	regsvr32.exe	17
PID 3028 wrote to memory of 1752	3028	regsvr32.exe	17
PID 3028 wrote to memory of 1752	3028	regsvr32.exe	17
PID 3028 wrote to memory of 1752	3028	regsvr32.exe	17

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\74d5a4ce54ae8ceff5f28bb9f20dd60f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\74d5a4ce54ae8ceff5f28bb9f20dd60f.dll
  2⤵
  - Modifies registry class
  PID:1752

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.