cc3fbfa0fa74fbc726e44e82698122ef072faba171c51b65c769b79b359d6790

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/certadm.dll
Size

83KB
MD5

aed39116fe12c5550975043da1d1b244
SHA1

ed8aa12a00e93c1a477f4ef69864948b4014a7fb
SHA256

bbba87bf62e8bdc11602f2a95712e5fe3fb1edbbcdeb28cbdcf191aeab286b04
SHA512

0ab9ef25bba0e231a140a5153c9f9149ab194a324f374e655e43ef90715e0417987d7f31f2493e229ec8b704bead31f0fbff6ee811d42cb7af8c58361979d132
SSDEEP

1536:MeZq3MXXTjmZ5IplbHKp/reRgMxcRircjVgrS9Ll2shT:MeZNvmnswKGMCZSrggsh

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9C735BE2-57A5-11D1-9BDB-00C04FB683FA}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EABAF0-7FB6-11D0-8817-00A0C903B83C}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateAuthority.View.1\CLSID\ = "{A12D0F7A-1E84-11D1-9BD6-00C04FB683FA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6853E76A-BD3E-11D1-9A4D-00C04FC297EB}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6DC5746E-1A01-11D3-9ED6-00C04F79731E}\ProgID\ = "CertificateAuthority.ExitManage.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{34DF6950-7FB6-11D0-8817-00A0C903B83C}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C3FAC344-1E84-11D1-9BD6-00C04FB683FA}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9C735BE2-57A5-11D1-9BDB-00C04FB683FA}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EABAF0-7FB6-11D0-8817-00A0C903B83C}\ProgID\ = "CertificateAuthority.Admin.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A12D0F7A-1E84-11D1-9BD6-00C04FB683FA}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateAuthority.PolicyManage\CLSID\ = "{6853E76A-BD3E-11D1-9A4D-00C04FC297EB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D1157F4C-5AF2-11D1-9BDC-00C04FB683FA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateAuthority.View.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6853E76A-BD3E-11D1-9A4D-00C04FC297EB}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E77DB656-7653-11D1-9BDE-00C04FB683FA}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7DD1466-7653-11D1-9BDE-00C04FB683FA}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7DD1466-7653-11D1-9BDE-00C04FB683FA}\TypeLib\ = "{35DE99A0-7FB6-11D0-8817-00A0C903B83C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateAuthority.Admin\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateAuthority.View\ = "CertView Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7C3AC41-B8CE-4FB4-AA58-3D1DC0E36B39}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{34DF6950-7FB6-11D0-8817-00A0C903B83C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C3FAC344-1E84-11D1-9BD6-00C04FB683FA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D1157F4C-5AF2-11D1-9BDC-00C04FB683FA}\TypeLib\ = "{35DE99A0-7FB6-11D0-8817-00A0C903B83C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateAuthority.Admin.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EABAF0-7FB6-11D0-8817-00A0C903B83C}\InprocServer32\ThreadingModel = "both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A12D0F7A-1E84-11D1-9BD6-00C04FB683FA}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D594B282-8851-4B61-9C66-3EDADF848863}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{35DE99A0-7FB6-11D0-8817-00A0C903B83C}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$TEMP"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D594B282-8851-4B61-9C66-3EDADF848863}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7DD1466-7653-11D1-9BDE-00C04FB683FA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateAuthority.Admin.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EABAF0-7FB6-11D0-8817-00A0C903B83C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$TEMP\\certadm.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateAuthority.ExitManage.1\ = "CertManageModule Class (exit legacy support)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E77DB656-7653-11D1-9BDE-00C04FB683FA}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7DD1466-7653-11D1-9BDE-00C04FB683FA}\TypeLib\ = "{35DE99A0-7FB6-11D0-8817-00A0C903B83C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{35DE99A0-7FB6-11D0-8817-00A0C903B83C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{34DF6950-7FB6-11D0-8817-00A0C903B83C}\TypeLib\ = "{35DE99A0-7FB6-11D0-8817-00A0C903B83C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C3FAC344-1E84-11D1-9BD6-00C04FB683FA}\TypeLib\ = "{35DE99A0-7FB6-11D0-8817-00A0C903B83C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9C735BE2-57A5-11D1-9BDB-00C04FB683FA}\ = "IEnumCERTVIEWCOLUMN"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateAuthority.Admin	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D594B282-8851-4B61-9C66-3EDADF848863}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D1157F4C-5AF2-11D1-9BDC-00C04FB683FA}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateAuthority.ExitManage\ = "CertManageModule Class (exit legacy support)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D594B282-8851-4B61-9C66-3EDADF848863}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E77DB656-7653-11D1-9BDE-00C04FB683FA}\ = "IEnumCERTVIEWATTRIBUTE"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E77DB656-7653-11D1-9BDE-00C04FB683FA}\ = "IEnumCERTVIEWATTRIBUTE"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9C735BE2-57A5-11D1-9BDB-00C04FB683FA}\ = "IEnumCERTVIEWCOLUMN"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D1157F4C-5AF2-11D1-9BDC-00C04FB683FA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9C735BE2-57A5-11D1-9BDB-00C04FB683FA}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateAuthority.Admin\CLSID\ = "{37EABAF0-7FB6-11D0-8817-00A0C903B83C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateAuthority.View\CLSID\ = "{A12D0F7A-1E84-11D1-9BD6-00C04FB683FA}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateAuthority.PolicyManage\ = "CertManageModule Class (policy legacy support)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CertificateAuthority.PolicyManage\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6853E76A-BD3E-11D1-9A4D-00C04FC297EB}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6DC5746E-1A01-11D3-9ED6-00C04F79731E}\ = "CertManageModule Class (exit legacy support)"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9C735BE2-57A5-11D1-9BDB-00C04FB683FA}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7DD1466-7653-11D1-9BDE-00C04FB683FA}\ = "IEnumCERTVIEWEXTENSION"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6853E76A-BD3E-11D1-9A4D-00C04FC297EB}\ProgID\ = "CertificateAuthority.PolicyManage.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34DF6950-7FB6-11D0-8817-00A0C903B83C}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D594B282-8851-4B61-9C66-3EDADF848863}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E77DB656-7653-11D1-9BDE-00C04FB683FA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7DD1466-7653-11D1-9BDE-00C04FB683FA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7C3AC41-B8CE-4FB4-AA58-3D1DC0E36B39}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{37EABAF0-7FB6-11D0-8817-00A0C903B83C}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 3040	2248	regsvr32.exe	28
PID 2248 wrote to memory of 3040	2248	regsvr32.exe	28
PID 2248 wrote to memory of 3040	2248	regsvr32.exe	28
PID 2248 wrote to memory of 3040	2248	regsvr32.exe	28
PID 2248 wrote to memory of 3040	2248	regsvr32.exe	28
PID 2248 wrote to memory of 3040	2248	regsvr32.exe	28
PID 2248 wrote to memory of 3040	2248	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$TEMP\certadm.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$TEMP\certadm.dll
  2⤵
  - Modifies registry class
  PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-0-0x0000000000130000-0x0000000000161000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads