3a31a48516be9b482ae858721d69f22cde7dbbda6bc68163147d1f154b962d02

Analysis

max time kernel
95s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 18:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8d15ee46e92078d52b537662c29317bc.exe
Size

139KB
MD5

8d15ee46e92078d52b537662c29317bc
SHA1

818512af8d3a98c02f77455a3775e2253d0e70e0
SHA256

3a31a48516be9b482ae858721d69f22cde7dbbda6bc68163147d1f154b962d02
SHA512

544e5ccc7329ae4247be8025199a98728ffebfd76aaaa425cc02425496ec0f27a9bc58409d39adf6687502ab2df0713f058e0a44e2c78d3a89aa7007dc6b4876
SSDEEP

3072:4fcgg5jWw4tQfj2g18KDHbMwO3uSPwE3jER+fy33/rUrq8:4f9g5jH774KD7MwOtPG+fw3E

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4520	8d15ee46e92078d52b537662c29317bc.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Anti v1.ocx	8d15ee46e92078d52b537662c29317bc.exe
File created	C:\Windows\SysWOW64\Anti v1.ocx	8d15ee46e92078d52b537662c29317bc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4520 set thread context of 4060	4520	8d15ee46e92078d52b537662c29317bc.exe	86

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\TypeLib\ = "{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}"	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\TypeLib	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\FLAGS\ = "2"	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ProxyStubClsid	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\VERSION\ = "1.0"	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ = "UserControl1"	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\TypeLib	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\TypeLib\Version = "1.0"	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\ProgID\ = "DmarAnti.UserControl1"	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ = "_UserControl1"	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\ = "DmarAnti"	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\TypeLib	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\InprocServer32\ThreadingModel = "Apartment"	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\MiscStatus\1\ = "131473"	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\0\win32	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ = "_UserControl1"	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\TypeLib	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ProxyStubClsid32	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\TypeLib\ = "{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}"	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\MiscStatus\1	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DmarAnti.UserControl1\Clsid	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DmarAnti.UserControl1\Clsid\ = "{CF070144-EB7B-4D63-BBFC-DABB33AE234C}"	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ProxyStubClsid32	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\TypeLib\ = "{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}"	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DmarAnti.UserControl1	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\HELPDIR	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\HELPDIR\ = "C:\\Windows\\system32"	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\TypeLib\ = "{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}"	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\ToolboxBitmap32	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\MiscStatus	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\FLAGS	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\ = "DmarAnti.UserControl1"	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\Control\	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\Anti v1.ocx, 30000"	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\TypeLib\ = "{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}"	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\VERSION	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\TypeLib\Version = "1.0"	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ProxyStubClsid32	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\InprocServer32	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\Control	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DmarAnti.UserControl1\ = "DmarAnti.UserControl1"	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\TypeLib\Version = "1.0"	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\0	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\TypeLib\Version = "1.0"	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\Anti v1.ocx"	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ = "__UserControl1"	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\ProgID	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ProxyStubClsid	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ = "UserControl1"	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}	8d15ee46e92078d52b537662c29317bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ProxyStubClsid32	8d15ee46e92078d52b537662c29317bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ = "__UserControl1"	8d15ee46e92078d52b537662c29317bc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4520	8d15ee46e92078d52b537662c29317bc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 4060	4520	8d15ee46e92078d52b537662c29317bc.exe	86
PID 4520 wrote to memory of 4060	4520	8d15ee46e92078d52b537662c29317bc.exe	86
PID 4520 wrote to memory of 4060	4520	8d15ee46e92078d52b537662c29317bc.exe	86
PID 4520 wrote to memory of 4060	4520	8d15ee46e92078d52b537662c29317bc.exe	86
PID 4520 wrote to memory of 4060	4520	8d15ee46e92078d52b537662c29317bc.exe	86
PID 4520 wrote to memory of 4060	4520	8d15ee46e92078d52b537662c29317bc.exe	86
PID 4520 wrote to memory of 4060	4520	8d15ee46e92078d52b537662c29317bc.exe	86

C:\Users\Admin\AppData\Local\Temp\8d15ee46e92078d52b537662c29317bc.exe
"C:\Users\Admin\AppData\Local\Temp\8d15ee46e92078d52b537662c29317bc.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Users\Admin\AppData\Local\Temp\8d15ee46e92078d52b537662c29317bc.exe
  C:\Users\Admin\AppData\Local\Temp\8d15ee46e92078d52b537662c29317bc.exe
  2⤵
  PID:4060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Anti v1.ocx

Filesize
32KB

MD5
e4aa837c58969cfcbe0b830a2f5f51b9

SHA1
8170f323075c3171bae60e078be4a854242372db

SHA256
bce81f610a13e8a49a7de03981a42be9778094ceda06d39317163de3c4113a7e

SHA512
accc7011665a5344277c2ac230e83e7802be1a28bbe5429d3c73455e1265728bdb3dc768f111d97d43a28d7f112224f4f53ecc910885024ef761d0a64d042b55

Download Submit
memory/4060-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4060-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4060-9-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/4060-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4060-14-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/4060-15-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/4060-16-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/4520-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4520-12-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download