fd339bc296af59ce75148e0d4f75256d7679d5894041dc0e4d1b821309dd4737

Analysis

max time kernel
138s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 08:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd339bc296af59ce75148e0d4f75256d7679d5894041dc0e4d1b821309dd4737.dll
Size

715KB
MD5

d3a49e0ccef799d6d10237037e10510b
SHA1

c09f817d2f295335c621e6cd820ecca6ead587b3
SHA256

fd339bc296af59ce75148e0d4f75256d7679d5894041dc0e4d1b821309dd4737
SHA512

618f6e0a54ae867971355fe516fd9af3863de2aef80b1bb30ee7e80855ed7edb5d4526a0264324c513127da23aa9adda7bb81bc577321785962601b17aedbd61
SSDEEP

12288:9wdofEyUhL0EGNW3oJdThiqhVcd/LT0rQraCWH:9wdo8yUhLVGNFjmL2d

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C0-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "9"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C1-BAF9-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D2-BAF9-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D8-BAFA-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5CA5F7F-1847-4D87-9C5B-918509F7511D}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F164EDF1-CC7C-4F0D-9A94-34222625C393}\ = "IInternetSecurityManagerEx"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ftp	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2AD1EDAF-D83D-48B5-9ADF-03DBE19F53BD}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C9-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F164EDF1-CC7C-4F0D-9A94-34222625C393}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\gzip\CLSID = "{8f6b0360-b80d-11d0-a9b3-006097942311}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79EAC9E4-BAF9-11CE-8C82-00AA004BA90B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fd339bc296af59ce75148e0d4f75256d7679d5894041dc0e4d1b821309dd4737.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local\CLSID = "{79eac9e7-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http\CLSID = "{79eac9e2-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\deflate\CLSID = "{8f6b0360-b80d-11d0-a9b3-006097942311}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}\ = "IInternetSecurityManager"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5CA5F7F-1847-4D87-9C5B-918509F7511D}\ = "IMonikerProp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5CA5F7F-1847-4D87-9C5B-918509F7511D}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml\ = "AP Deflate Encoding/Decoding Filter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1E50292-A795-4117-8E09-2B560A72AC60}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A39EE748-6A27-4817-A6F2-13914BEF5890}\NumMethods\ = "28"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAA74EF9-8EE7-4659-88D9-F8C504DA73CC}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D6-BAFA-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\cdl\CLSID = "{3dd53d40-7b8b-11d0-b013-00aa0059ce02}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\file\ = "file:, local: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\file\CLSID = "{79eac9e7-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\file	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAA74EF9-8EE7-4659-88D9-F8C504DA73CC}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F9F9FCB-E0F4-48EB-B7AB-FA2EA9365CB4}\ = "IHttpNegotiate2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F9F9FCB-E0F4-48EB-B7AB-FA2EA9365CB4}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F164EDF1-CC7C-4F0D-9A94-34222625C393}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F6B0360-B80D-11D0-A9B3-006097942311}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F6B0360-B80D-11D0-A9B3-006097942311}\ = "AP lzdhtml encoding/decoding Filter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\gopher	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C0-BAF9-11CE-8C82-00AA004BA90B}\ = "IBinding"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C0-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAA74EF9-8EE7-4659-88D9-F8C504DA73CC}\NumMethods\ = "12"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\gopher\CLSID = "{79eac9e4-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\cdl	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ftp\CLSID = "{79eac9e3-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C1-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "11"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D6-BAFA-11CE-8C82-00AA004BA90B}\ = "IWinInetInfo"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F164EDF1-CC7C-4F0D-9A94-34222625C393}\NumMethods\ = "12"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1E50292-A795-4117-8E09-2B560A72AC60}\NumMethods\ = "16"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1E50292-A795-4117-8E09-2B560A72AC60}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local\ = "file:, local: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5CA5F7F-1847-4D87-9C5B-918509F7511D}\NumMethods\ = "4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A39EE748-6A27-4817-A6F2-13914BEF5890}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C1-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F9F9FCB-E0F4-48EB-B7AB-FA2EA9365CB4}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC4801A1-2BA9-11CF-A229-00AA003D7352}\ = "IBindHost"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D6-BAFA-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D6-BAFA-11CE-8C82-00AA004BA90B}\NumMethods\ = "4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https\ = "https: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C0-BAF9-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C1-BAF9-11CE-8C82-00AA004BA90B}\ = "IBindStatusCallback"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC4801A1-2BA9-11CF-A229-00AA003D7352}\NumMethods\ = "6"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 3448	4600	regsvr32.exe	79
PID 4600 wrote to memory of 3448	4600	regsvr32.exe	79
PID 4600 wrote to memory of 3448	4600	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fd339bc296af59ce75148e0d4f75256d7679d5894041dc0e4d1b821309dd4737.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fd339bc296af59ce75148e0d4f75256d7679d5894041dc0e4d1b821309dd4737.dll
  2⤵
  - Modifies registry class
  PID:3448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RGI990.tmp

Filesize
19KB

MD5
b1444079ef9a1b87ab15f45927434e58

SHA1
63902d741606e20b08043c8c1e72de180f0d2bf4

SHA256
0944de2f087f76b0ed15a0008186817e22419afc4c400d00be2670fedafa9899

SHA512
5df4b63d9787557a2196ccead70b747da0edd09732577111b932b3fb1dc3b545b004b94d2d2f57e5bcb2565bc94e3e98dd732e598cd0e0d295902065393a0c9f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads