dc9004debeedaf630fc537b2200ce3a742a45af5478cecf2fccdd35ffa15cac5

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CloudFun2.dll
Size

48KB
MD5

4c494d8cf201b203179f72f6326a6b2e
SHA1

86936c53fe8ba36372be69f6cff6aa75bd8bf890
SHA256

0599b016d27e85ceb73f8eebf440ecc04eee03d1eae2bd8cdbaaed80e57f5feb
SHA512

f84d935453c2eb225093582f49a03d70743cc8b849899869b0c4a06a688be857a5fec61dff78503883b3cdb8c25276b007e91a777036a62e38de61c3f8739ceb
SSDEEP

768:6+SrZq6TnZYlo/EkFah0+xt+hJawnjMnuYUw4sC+SirO9:7SrZq6DnzFG2JawjMuYUnsC+SirO9

Score

1^/10

Malware Config

Signatures

Modifies registry class 51 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CloudFun.VersionFun2.1\CLSID\ = "{05FF1822-FC58-4578-B979-1F5863867DD7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{886A3054-3CBB-4B95-9084-E8D79AE7DBBA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{886A3054-3CBB-4B95-9084-E8D79AE7DBBA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CloudFun.VersionFun2\ = "VersionFun2 Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CloudFun.VersionFun2\CLSID\ = "{05FF1822-FC58-4578-B979-1F5863867DD7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3B77613E-D351-418C-887D-D9D2A70993E9}\1.0\ = "CloudFun 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{886A3054-3CBB-4B95-9084-E8D79AE7DBBA}\ = "IVersionFun"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05FF1822-FC58-4578-B979-1F5863867DD7}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05FF1822-FC58-4578-B979-1F5863867DD7}\ProgID\ = "CloudFun.VersionFun2.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{886A3054-3CBB-4B95-9084-E8D79AE7DBBA}\TypeLib\ = "{3B77613E-D351-418C-887D-D9D2A70993E9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3B77613E-D351-418C-887D-D9D2A70993E9}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{886A3054-3CBB-4B95-9084-E8D79AE7DBBA}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{886A3054-3CBB-4B95-9084-E8D79AE7DBBA}\ = "IVersionFun"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CloudFun.VersionFun2.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05FF1822-FC58-4578-B979-1F5863867DD7}\VersionIndependentProgID\ = "CloudFun.VersionFun2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05FF1822-FC58-4578-B979-1F5863867DD7}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3B77613E-D351-418C-887D-D9D2A70993E9}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{886A3054-3CBB-4B95-9084-E8D79AE7DBBA}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{886A3054-3CBB-4B95-9084-E8D79AE7DBBA}\TypeLib\ = "{3B77613E-D351-418C-887D-D9D2A70993E9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{886A3054-3CBB-4B95-9084-E8D79AE7DBBA}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05FF1822-FC58-4578-B979-1F5863867DD7}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CloudFun.VersionFun2\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05FF1822-FC58-4578-B979-1F5863867DD7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CloudFun2.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05FF1822-FC58-4578-B979-1F5863867DD7}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05FF1822-FC58-4578-B979-1F5863867DD7}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CloudFun.VersionFun2.1\ = "VersionFun2 Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3B77613E-D351-418C-887D-D9D2A70993E9}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{886A3054-3CBB-4B95-9084-E8D79AE7DBBA}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3B77613E-D351-418C-887D-D9D2A70993E9}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CloudFun.VersionFun2	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CloudFun.VersionFun2.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05FF1822-FC58-4578-B979-1F5863867DD7}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3B77613E-D351-418C-887D-D9D2A70993E9}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CloudFun.VersionFun2\CurVer\ = "CloudFun.VersionFun2.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05FF1822-FC58-4578-B979-1F5863867DD7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05FF1822-FC58-4578-B979-1F5863867DD7}\ = "VersionFun2 Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3B77613E-D351-418C-887D-D9D2A70993E9}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CloudFun2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{886A3054-3CBB-4B95-9084-E8D79AE7DBBA}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05FF1822-FC58-4578-B979-1F5863867DD7}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CloudFun.VersionFun2\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3B77613E-D351-418C-887D-D9D2A70993E9}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{886A3054-3CBB-4B95-9084-E8D79AE7DBBA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{886A3054-3CBB-4B95-9084-E8D79AE7DBBA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05FF1822-FC58-4578-B979-1F5863867DD7}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05FF1822-FC58-4578-B979-1F5863867DD7}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05FF1822-FC58-4578-B979-1F5863867DD7}\TypeLib\ = "{3B77613E-D351-418C-887D-D9D2A70993E9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3B77613E-D351-418C-887D-D9D2A70993E9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3B77613E-D351-418C-887D-D9D2A70993E9}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{886A3054-3CBB-4B95-9084-E8D79AE7DBBA}\TypeLib\Version = "1.0"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1884	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1884	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1884	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1884	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1884	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1884	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1884	1928	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\CloudFun2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\CloudFun2.dll
  2⤵
  - Modifies registry class
  PID:1884

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads