8f1a49544decb8ece3aed3a8ec474915b164221aa9f48d4f76bcc804d97d8ad1

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

orange/StoneXP.dll
Size

314KB
MD5

010f623a9af7ed14aad3b19a6b8788e7
SHA1

61bb5c51c7909a6ad08c2001adbb021f3776ce76
SHA256

acbdb3eb07a75b9a5599e7421292cb4bb9b97239fd5354358b20fddf72125295
SHA512

fbfa96831ea74d538d2f7b3b154fabf7b1a79f5e434a79d2f3fa45e0d8c6ba1ee7580ade9932a1762193f5765d6b04f5da533388a928a3c388b14fddaeaaadeb
SSDEEP

6144:KPQj6HgZY4Uou6K2MJRaalmEcd+fBsFkXYD0jlG:WhAtUou6K2MTIkoD0jk

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E8834BB4-FF9C-4CFC-BC1A-2DFCB422BD36}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04FED79F-F10C-4AF5-865E-212BB3E4CCAF}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\orange\\StoneXP.dll, 30002"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5FFB1242-F79C-4137-BC91-FE9F697BF3EF}\ = "_XPFrame"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8973663D-5651-4180-B767-532EF4C53469}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1A02900-F7D0-423A-8CE1-A0F516ED3FDB}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{155B96F2-E290-4545-BBA9-DC156A7444B0}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8973663D-5651-4180-B767-532EF4C53469}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E8834BB4-FF9C-4CFC-BC1A-2DFCB422BD36}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A08EECAB-E7D3-4D90-9105-931155AA5D3C}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A08EECAB-E7D3-4D90-9105-931155AA5D3C}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04FED79F-F10C-4AF5-865E-212BB3E4CCAF}\TypeLib\ = "{CFA7AFF4-3242-4269-9172-7389D695AE01}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8973663D-5651-4180-B767-532EF4C53469}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{155B96F2-E290-4545-BBA9-DC156A7444B0}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A08EECAB-E7D3-4D90-9105-931155AA5D3C}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StoneXP.XPButton\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1D382A80-05FF-455D-A187-74331C0847DB}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14C24B71-2418-4CBB-8EA5-350666105685}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{38257075-20DC-4CC3-8959-4F287C821279}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0EA7D35-FF13-4350-B95A-77350381F031}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8973663D-5651-4180-B767-532EF4C53469}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7811A721-63DF-4254-B75E-2503C066F502}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1D382A80-05FF-455D-A187-74331C0847DB}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A08EECAB-E7D3-4D90-9105-931155AA5D3C}\ProgID\ = "StoneXP.XPRadioButton"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78B274B2-861A-4D74-930F-9BCDA3CA61E9}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E8834BB4-FF9C-4CFC-BC1A-2DFCB422BD36}\ = "__XPRadioButton"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7A573918-C91B-460B-9B5B-BA44DA14FB25}\ = "__XPTab"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04FED79F-F10C-4AF5-865E-212BB3E4CCAF}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48BFDA68-6B53-410B-9B4B-7FB4511F423E}\VERSION\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CFA7AFF4-3242-4269-9172-7389D695AE01}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{104F2AFA-2518-4E50-8476-CDBECD8C0D67}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14C24B71-2418-4CBB-8EA5-350666105685}\VERSION	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{38257075-20DC-4CC3-8959-4F287C821279}\TypeLib\ = "{CFA7AFF4-3242-4269-9172-7389D695AE01}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8973663D-5651-4180-B767-532EF4C53469}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7811A721-63DF-4254-B75E-2503C066F502}\TypeLib\ = "{CFA7AFF4-3242-4269-9172-7389D695AE01}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04FED79F-F10C-4AF5-865E-212BB3E4CCAF}\ = "StoneXP.XPProgressBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A08EECAB-E7D3-4D90-9105-931155AA5D3C}\VERSION\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5FFB1242-F79C-4137-BC91-FE9F697BF3EF}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48BFDA68-6B53-410B-9B4B-7FB4511F423E}\VERSION	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{155B96F2-E290-4545-BBA9-DC156A7444B0}\ = "_XPProgressBar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{38257075-20DC-4CC3-8959-4F287C821279}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1A02900-F7D0-423A-8CE1-A0F516ED3FDB}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E8834BB4-FF9C-4CFC-BC1A-2DFCB422BD36}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A08EECAB-E7D3-4D90-9105-931155AA5D3C}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72FB1411-C381-4FA0-A907-0FF4E1B96194}\MiscStatus\1\ = "213393"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0EA7D35-FF13-4350-B95A-77350381F031}\ = "XPRadioButton"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14C24B71-2418-4CBB-8EA5-350666105685}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CFA7AFF4-3242-4269-9172-7389D695AE01}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{155B96F2-E290-4545-BBA9-DC156A7444B0}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1D382A80-05FF-455D-A187-74331C0847DB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1A02900-F7D0-423A-8CE1-A0F516ED3FDB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E8834BB4-FF9C-4CFC-BC1A-2DFCB422BD36}\ = "XPRadioButton"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04FED79F-F10C-4AF5-865E-212BB3E4CCAF}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StoneXP.XPCheckBox	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StoneXP.XPButton\Clsid\ = "{48BFDA68-6B53-410B-9B4B-7FB4511F423E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{38257075-20DC-4CC3-8959-4F287C821279}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0EA7D35-FF13-4350-B95A-77350381F031}\ = "_XPRadioButton"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1A02900-F7D0-423A-8CE1-A0F516ED3FDB}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8973663D-5651-4180-B767-532EF4C53469}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72FB1411-C381-4FA0-A907-0FF4E1B96194}\TypeLib\ = "{CFA7AFF4-3242-4269-9172-7389D695AE01}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72FB1411-C381-4FA0-A907-0FF4E1B96194}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04FED79F-F10C-4AF5-865E-212BB3E4CCAF}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0EA7D35-FF13-4350-B95A-77350381F031}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1A02900-F7D0-423A-8CE1-A0F516ED3FDB}\ = "__XPCheckBox"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StoneXP.XPRadioButton\Clsid\ = "{A08EECAB-E7D3-4D90-9105-931155AA5D3C}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 116	3360	regsvr32.exe	82
PID 3360 wrote to memory of 116	3360	regsvr32.exe	82
PID 3360 wrote to memory of 116	3360	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\orange\StoneXP.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\orange\StoneXP.dll
  2⤵
  - Modifies registry class
  PID:116

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads