013f49b1709a70e58968ff552cfdce0fa9903dfd276e5b092a23a05a782f5db3

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MaxDelete.dll
Size

384KB
MD5

2b19a0405e4b3dc23b29949f5217875b
SHA1

5e128f5f46de8b7c496655776f9a5dac7b81aa5f
SHA256

24f8415844a35175564de800d36dba5e5b5bcdf9f2a9418653fc4451c9e2f172
SHA512

6e02a6057af40f81cfbfb241f2a6cc58d8bdb483af2c7b2b2e830b2dbf56b4702f63244583685116ec5c67e41db9e3c231a22935075eae57f27cc90a275ee1f4
SSDEEP

6144:kBAa6+dfLYcetJK1aw5oRgw44d188itnqqEP7cM08AJV:Lajdf80dqRgw44d1Atq9TNA3

Score

1^/10

Malware Config

Signatures

Modifies registry class 54 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DLLReg.DLLRegShlExt\ = "MaxDelete Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DLLReg.DLLRegShlExt\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D78C0E02-3578-4607-B494-939CF96CC53E}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D78C0E65-3578-4607-B494-939CF96CC53E}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D78C0E71-3578-4607-B494-939CF96CC53E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D78C0E71-3578-4607-B494-939CF96CC53E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\MaxDelete	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D78C0E02-3578-4607-B494-939CF96CC53E}\ = "MaxDelete Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\MaxDelete\ = "{D78C0E02-3578-4607-B494-939CF96CC53E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D78C0E65-3578-4607-B494-939CF96CC53E}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D78C0E65-3578-4607-B494-939CF96CC53E}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DLLReg.DLLRegShlExt.1\ = "MaxDelete Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DLLReg.DLLRegShlExt.1\CLSID\ = "{D78C0E02-3578-4607-B494-939CF96CC53E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DLLReg.DLLRegShlExt\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D78C0E02-3578-4607-B494-939CF96CC53E}\VersionIndependentProgID\ = "DLLReg.DLLRegShlExt"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D78C0E02-3578-4607-B494-939CF96CC53E}\ProgID\ = "DLLReg.DLLRegShlExt.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D78C0E02-3578-4607-B494-939CF96CC53E}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D78C0E71-3578-4607-B494-939CF96CC53E}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D78C0E71-3578-4607-B494-939CF96CC53E}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D78C0E65-3578-4607-B494-939CF96CC53E}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D78C0E71-3578-4607-B494-939CF96CC53E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D78C0E02-3578-4607-B494-939CF96CC53E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D78C0E65-3578-4607-B494-939CF96CC53E}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D78C0E71-3578-4607-B494-939CF96CC53E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D78C0E02-3578-4607-B494-939CF96CC53E}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\MaxDelete	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D78C0E65-3578-4607-B494-939CF96CC53E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D78C0E71-3578-4607-B494-939CF96CC53E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D78C0E71-3578-4607-B494-939CF96CC53E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D78C0E71-3578-4607-B494-939CF96CC53E}\ = "IDLLRegShlExt"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D78C0E71-3578-4607-B494-939CF96CC53E}\TypeLib\ = "{D78C0E65-3578-4607-B494-939CF96CC53E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D78C0E71-3578-4607-B494-939CF96CC53E}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DLLReg.DLLRegShlExt.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D78C0E02-3578-4607-B494-939CF96CC53E}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D78C0E02-3578-4607-B494-939CF96CC53E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MaxDelete.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\MaxDelete	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D78C0E71-3578-4607-B494-939CF96CC53E}\ = "IDLLRegShlExt"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D78C0E71-3578-4607-B494-939CF96CC53E}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DLLReg.DLLRegShlExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DLLReg.DLLRegShlExt\CLSID\ = "{D78C0E02-3578-4607-B494-939CF96CC53E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\MaxDelete\ = "{D78C0E02-3578-4607-B494-939CF96CC53E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\MaxDelete	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D78C0E02-3578-4607-B494-939CF96CC53E}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\MaxDelete\ = "{D78C0E02-3578-4607-B494-939CF96CC53E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D78C0E65-3578-4607-B494-939CF96CC53E}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DLLReg.DLLRegShlExt.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D78C0E65-3578-4607-B494-939CF96CC53E}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D78C0E71-3578-4607-B494-939CF96CC53E}\TypeLib\ = "{D78C0E65-3578-4607-B494-939CF96CC53E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DLLReg.DLLRegShlExt\CurVer\ = "DLLReg.DLLRegShlExt.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D78C0E02-3578-4607-B494-939CF96CC53E}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D78C0E02-3578-4607-B494-939CF96CC53E}\TypeLib\ = "{D78C0E65-3578-4607-B494-939CF96CC53E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\MaxDelete\ = "{D78C0E02-3578-4607-B494-939CF96CC53E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D78C0E65-3578-4607-B494-939CF96CC53E}\1.0\ = "MaxDelete 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D78C0E65-3578-4607-B494-939CF96CC53E}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MaxDelete.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2628	2052	regsvr32.exe	28
PID 2052 wrote to memory of 2628	2052	regsvr32.exe	28
PID 2052 wrote to memory of 2628	2052	regsvr32.exe	28
PID 2052 wrote to memory of 2628	2052	regsvr32.exe	28
PID 2052 wrote to memory of 2628	2052	regsvr32.exe	28
PID 2052 wrote to memory of 2628	2052	regsvr32.exe	28
PID 2052 wrote to memory of 2628	2052	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\MaxDelete.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\MaxDelete.dll
  2⤵
  - Modifies registry class
  PID:2628

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads