ba36666250ef79a97d3f431fbbe5ce50914689f2a2a4f6c010c29d81e3a4ce37

Analysis

max time kernel
93s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2024, 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare-015caa166a54fcc971bb0272b65c3c6f.dll
Size

176KB
MD5

015caa166a54fcc971bb0272b65c3c6f
SHA1

a31a35095554666123df4f22350532e9d71babe4
SHA256

ba36666250ef79a97d3f431fbbe5ce50914689f2a2a4f6c010c29d81e3a4ce37
SHA512

b7428cead64ae4e19c9a689b099af831e971fac6edd2def8de2f6e55e37d649566f011954d547426f757c40107731437dbf4980c8b0420c55f9470c48b94a975
SSDEEP

3072:OqCVA9leVw8oL+0NfU6/VfGzfRdrqq7SdEnl3Fz3nzSytH4ecE5:5CW9Swf+0Nfr/VGjHrqg3YecQ

Score

1^/10

Malware Config

Signatures

Modifies registry class 60 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0594AF7E-573B-40DF-8165-E47AB2EAEFE8}\ProgID\ = "EGAUTH.EGEGAUTH.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0594AF7E-573B-40DF-8165-E47AB2EAEFE8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A58F3D09-4543-4396-8BE7-105F14DD6ED5}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A58F3D09-4543-4396-8BE7-105F14DD6ED5}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3947AC1D-DB09-4353-BBCC-55B97F5035EF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EGAUTH.EGEGAUTH\ = "EGEGAUTH Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0594AF7E-573B-40DF-8165-E47AB2EAEFE8}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A58F3D09-4543-4396-8BE7-105F14DD6ED5}\ = "_IEGEGAUTHEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3947AC1D-DB09-4353-BBCC-55B97F5035EF}\ = "IEGAUTHCLIENT"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0594AF7E-573B-40DF-8165-E47AB2EAEFE8}\ = "EGEGAUTH Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0594AF7E-573B-40DF-8165-E47AB2EAEFE8}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A58F3D09-4543-4396-8BE7-105F14DD6ED5}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A58F3D09-4543-4396-8BE7-105F14DD6ED5}\ = "_IEGEGAUTHEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3947AC1D-DB09-4353-BBCC-55B97F5035EF}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EGAUTH.EGEGAUTH\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E594D22-ACE6-43A2-BCDA-BB7C65D3FE8C}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E594D22-ACE6-43A2-BCDA-BB7C65D3FE8C}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3947AC1D-DB09-4353-BBCC-55B97F5035EF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EGAUTH.EGEGAUTH.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A58F3D09-4543-4396-8BE7-105F14DD6ED5}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EGAUTH.EGEGAUTH\CLSID\ = "{0594AF7E-573B-40DF-8165-E47AB2EAEFE8}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0594AF7E-573B-40DF-8165-E47AB2EAEFE8}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0594AF7E-573B-40DF-8165-E47AB2EAEFE8}\VersionIndependentProgID\ = "EGAUTH.EGEGAUTH"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0594AF7E-573B-40DF-8165-E47AB2EAEFE8}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0594AF7E-573B-40DF-8165-E47AB2EAEFE8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VirusShare-015caa166a54fcc971bb0272b65c3c6f.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3947AC1D-DB09-4353-BBCC-55B97F5035EF}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EGAUTH.EGEGAUTH.1\CLSID\ = "{0594AF7E-573B-40DF-8165-E47AB2EAEFE8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0594AF7E-573B-40DF-8165-E47AB2EAEFE8}\TypeLib\ = "{0E594D22-ACE6-43A2-BCDA-BB7C65D3FE8C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A58F3D09-4543-4396-8BE7-105F14DD6ED5}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E594D22-ACE6-43A2-BCDA-BB7C65D3FE8C}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VirusShare-015caa166a54fcc971bb0272b65c3c6f.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3947AC1D-DB09-4353-BBCC-55B97F5035EF}\TypeLib\ = "{0E594D22-ACE6-43A2-BCDA-BB7C65D3FE8C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0594AF7E-573B-40DF-8165-E47AB2EAEFE8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E594D22-ACE6-43A2-BCDA-BB7C65D3FE8C}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A58F3D09-4543-4396-8BE7-105F14DD6ED5}\TypeLib\ = "{0E594D22-ACE6-43A2-BCDA-BB7C65D3FE8C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A58F3D09-4543-4396-8BE7-105F14DD6ED5}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A58F3D09-4543-4396-8BE7-105F14DD6ED5}\TypeLib\ = "{0E594D22-ACE6-43A2-BCDA-BB7C65D3FE8C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3947AC1D-DB09-4353-BBCC-55B97F5035EF}\TypeLib\ = "{0E594D22-ACE6-43A2-BCDA-BB7C65D3FE8C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3947AC1D-DB09-4353-BBCC-55B97F5035EF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3947AC1D-DB09-4353-BBCC-55B97F5035EF}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EGAUTH.EGEGAUTH\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0594AF7E-573B-40DF-8165-E47AB2EAEFE8}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E594D22-ACE6-43A2-BCDA-BB7C65D3FE8C}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E594D22-ACE6-43A2-BCDA-BB7C65D3FE8C}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A58F3D09-4543-4396-8BE7-105F14DD6ED5}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3947AC1D-DB09-4353-BBCC-55B97F5035EF}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E594D22-ACE6-43A2-BCDA-BB7C65D3FE8C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E594D22-ACE6-43A2-BCDA-BB7C65D3FE8C}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E594D22-ACE6-43A2-BCDA-BB7C65D3FE8C}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E594D22-ACE6-43A2-BCDA-BB7C65D3FE8C}\1.0\ = "EGAUTH 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A58F3D09-4543-4396-8BE7-105F14DD6ED5}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EGAUTH.EGEGAUTH	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EGAUTH.EGEGAUTH\CurVer\ = "EGAUTH.EGEGAUTH.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A58F3D09-4543-4396-8BE7-105F14DD6ED5}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A58F3D09-4543-4396-8BE7-105F14DD6ED5}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3947AC1D-DB09-4353-BBCC-55B97F5035EF}\ = "IEGAUTHCLIENT"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EGAUTH.EGEGAUTH.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EGAUTH.EGEGAUTH.1\ = "EGEGAUTH Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3947AC1D-DB09-4353-BBCC-55B97F5035EF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3947AC1D-DB09-4353-BBCC-55B97F5035EF}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3947AC1D-DB09-4353-BBCC-55B97F5035EF}\ProxyStubClsid32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 640	1248	regsvr32.exe	86
PID 1248 wrote to memory of 640	1248	regsvr32.exe	86
PID 1248 wrote to memory of 640	1248	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\VirusShare-015caa166a54fcc971bb0272b65c3c6f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\VirusShare-015caa166a54fcc971bb0272b65c3c6f.dll
  2⤵
  - Modifies registry class
  PID:640

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads