4381902e014623740cf01e659fce422ad2c2ffd4dcf491be648b4b4cf4f0f7ec | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-02-2024 13:09

Sharing

Report Analysis Logs

General

Target

QZone/Mfc42.dll
Size

972KB
MD5

08eabbd51ef3326014389e6039c06278
SHA1

b5a22ce71f54d5aa8fbe432191631b002bc4b10d
SHA256

456716d6bab61a392a5a99d3ed062cec3211c47f9fb78f76d95ee8d41577ed21
SHA512

88e5febbc2984da251e0dfd42a5da749b7930339956d7e90ad56f3601fed6bd4a17b5456f0ae70f01849ffa7ee9fff7132f7ee7b0a34514bf2ce211299635f7d
SSDEEP

12288:10AeYHUjb4eTQdLii8KzOs3MmnaKDc/1np96FXFLAJiVgP+zQci8Ii8:14Y02iI3YKDc/YX5+ZPgl8

Score

1^/10

Malware Config

Signatures

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE35201-8F91-11CE-9DE3-00AA004BB851}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE35202-8F91-11CE-9DE3-00AA004BB851}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE35202-8F91-11CE-9DE3-00AA004BB851}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE35200-8F91-11CE-9DE3-00AA004BB851}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE35200-8F91-11CE-9DE3-00AA004BB851}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE35201-8F91-11CE-9DE3-00AA004BB851}	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2368	2144	regsvr32.exe	28
PID 2144 wrote to memory of 2368	2144	regsvr32.exe	28
PID 2144 wrote to memory of 2368	2144	regsvr32.exe	28
PID 2144 wrote to memory of 2368	2144	regsvr32.exe	28
PID 2144 wrote to memory of 2368	2144	regsvr32.exe	28
PID 2144 wrote to memory of 2368	2144	regsvr32.exe	28
PID 2144 wrote to memory of 2368	2144	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\QZone\Mfc42.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\QZone\Mfc42.dll
  2⤵
  - Modifies registry class
  PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads