78a510dcd9f4fd929c73ae86575d248522080adbd04018d8fb74367c056138ca

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acfe6267172764d861ac4f6d0c9eb945.dll
Size

248KB
MD5

acfe6267172764d861ac4f6d0c9eb945
SHA1

79c0e0aa0c5524f0e771ef22876d4e82a2bb4302
SHA256

78a510dcd9f4fd929c73ae86575d248522080adbd04018d8fb74367c056138ca
SHA512

45b195a5c046c84c5cce632426dc81b40df25d1eca95e92940d5382fbce8f0e884805e4e86d73384d1ed5dcd1135ec70644b568f3dac149068dfc7112c340e0d
SSDEEP

6144:daNQaYSetJt4AhI4l/heBqgN0REtf5HQMN:jhS+L4AhgBFwEz

Score

1^/10

Malware Config

Signatures

Modifies registry class 55 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{620EFE9D-34ED-4DD4-B079-F495038AA998}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{620EFE9D-34ED-4DD4-B179-F495038AA990}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{620EFE9D-34ED-4DD4-B179-F495038AA990}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{620EFE9D-34ED-4DD4-B179-F495038AA990}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{620EFE9D-34ED-4DD4-B179-F495038AA990}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{620EFE9D-34ED-4DD4-B079-F495038AA998}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\DllSurrogate	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\ = "IE LiveTV"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bho.bho	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{620EFE9D-34ED-4DD4-B079-F495038AA998}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{620EFE9D-34ED-4DD4-B079-F495038AA998}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\acfe6267172764d861ac4f6d0c9eb945.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{620EFE9D-34ED-4DD4-B179-F495038AA990}\TypeLib\ = "{620EFE9D-34ED-4DD4-B079-F495038AA998}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bho.bho\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\acfe6267172764d861ac4f6d0c9eb945.dll	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{620EFE9D-34ED-4DD4-B179-F495038AA990}\ProxyStubClsid32	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\AccessPermission = 01000480440000005400000000000000140000000200300002000000000014000300000001010000000000050400000000001400030000000101000000000005120000000102000000000005200000002002000001020000000000052000000020020000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{620EFE9D-34ED-4DD4-B079-F495038AA998}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\ProgID\ = "bho.bho"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{620EFE9D-34ED-4DD4-B079-F495038AA998}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bho.bho\Clsid\ = "{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\TypeLib\ = "{620EFE9D-34ED-4DD4-B079-F495038AA998}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{620EFE9D-34ED-4DD4-B079-F495038AA998}\1.0\ = "IE_LiveTV"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{620EFE9D-34ED-4DD4-B179-F495038AA990}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\ = "IE LiveTV"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\acfe6267172764d861ac4f6d0c9eb945.dll\AppID = "{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\AppID = "{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{620EFE9D-34ED-4DD4-B179-F495038AA990}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{620EFE9D-34ED-4DD4-B179-F495038AA990}\TypeLib\ = "{620EFE9D-34ED-4DD4-B079-F495038AA998}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\Elevation	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{620EFE9D-34ED-4DD4-B079-F495038AA998}\1.0\0	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\Elevation\Enabled = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{620EFE9D-34ED-4DD4-B179-F495038AA990}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{620EFE9D-34ED-4DD4-B179-F495038AA990}\ = "IntfVideo"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{620EFE9D-34ED-4DD4-B079-F495038AA998}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{620EFE9D-34ED-4DD4-B179-F495038AA990}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{620EFE9D-34ED-4DD4-B179-F495038AA990}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bho.bho\ = "IE LiveTV"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{620EFE9D-34ED-4DD4-B079-F495038AA998}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\acfe6267172764d861ac4f6d0c9eb945.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\LocalizedString = "@C:\\Users\\Admin\\AppData\\Local\\Temp\\acfe6267172764d861ac4f6d0c9eb945.dll,-313"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{620EFE9D-34ED-4DD4-B179-F495038AA990}\ = "IntfVideo"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{45245B53-72FB-46CA-B5F5-ABA01D9B8E51}\Implemented Categories	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 2432	4844	regsvr32.exe	87
PID 4844 wrote to memory of 2432	4844	regsvr32.exe	87
PID 4844 wrote to memory of 2432	4844	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\acfe6267172764d861ac4f6d0c9eb945.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\acfe6267172764d861ac4f6d0c9eb945.dll
  2⤵
  - Modifies registry class
  PID:2432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2432-0-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/2432-1-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/2432-2-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads