cfe4aafd530bdc46bbcc608e00b1ccd33fdd8b0570ad39d746b2b7209a1743ce

Analysis

max time kernel
143s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 11:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

abc2a78442f1d8448374f86fa41d6ad7.dll
Size

216KB
MD5

abc2a78442f1d8448374f86fa41d6ad7
SHA1

35a9b6b9954a829cfa517b2f708c6a7cdb7b8e81
SHA256

cfe4aafd530bdc46bbcc608e00b1ccd33fdd8b0570ad39d746b2b7209a1743ce
SHA512

604ba3eafeb7b8c9367bfc408f2c321d45dd0b1dd9715039ae857875657f94a0fa457c70641e6a17a28aa508e4817026c9b2390a5d9f56397cfaf571811abc95
SSDEEP

6144:lOK1M8AmypQyFXEQyM7ikChgJ4XXLVZDH:lOOXLD

Score

1^/10

Malware Config

Signatures

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F2A9129-4C22-471A-A2E4-AC30AEA37DA9}\2d.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C3ACA9F-1B54-4492-8EF2-81BC17BB52A8}\TypeLib\ = "{0F2A9129-4C22-471A-A2E4-AC30AEA37DA9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6BE4ACDC-9F9D-49FA-A872-663A4306E91E}\ = "takepiece.Set"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6BE4ACDC-9F9D-49FA-A872-663A4306E91E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\abc2a78442f1d8448374f86fa41d6ad7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\takepiece.Set\ = "takepiece.Set"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\takepiece.Set\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C3ACA9F-1B54-4492-8EF2-81BC17BB52A8}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6BE4ACDC-9F9D-49FA-A872-663A4306E91E}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C3ACA9F-1B54-4492-8EF2-81BC17BB52A8}\TypeLib\Version = "2d.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C3ACA9F-1B54-4492-8EF2-81BC17BB52A8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C3ACA9F-1B54-4492-8EF2-81BC17BB52A8}\TypeLib\Version = "2d.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6BE4ACDC-9F9D-49FA-A872-663A4306E91E}\TypeLib\ = "{0F2A9129-4C22-471A-A2E4-AC30AEA37DA9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\takepiece.Set	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F2A9129-4C22-471A-A2E4-AC30AEA37DA9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F2A9129-4C22-471A-A2E4-AC30AEA37DA9}\2d.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\abc2a78442f1d8448374f86fa41d6ad7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F2A9129-4C22-471A-A2E4-AC30AEA37DA9}\2d.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C3ACA9F-1B54-4492-8EF2-81BC17BB52A8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C3ACA9F-1B54-4492-8EF2-81BC17BB52A8}\ = "_Set"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C3ACA9F-1B54-4492-8EF2-81BC17BB52A8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C3ACA9F-1B54-4492-8EF2-81BC17BB52A8}\ = "Set"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C3ACA9F-1B54-4492-8EF2-81BC17BB52A8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6BE4ACDC-9F9D-49FA-A872-663A4306E91E}\VERSION\ = "45.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6BE4ACDC-9F9D-49FA-A872-663A4306E91E}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6BE4ACDC-9F9D-49FA-A872-663A4306E91E}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F2A9129-4C22-471A-A2E4-AC30AEA37DA9}\2d.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F2A9129-4C22-471A-A2E4-AC30AEA37DA9}\2d.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C3ACA9F-1B54-4492-8EF2-81BC17BB52A8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6BE4ACDC-9F9D-49FA-A872-663A4306E91E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6BE4ACDC-9F9D-49FA-A872-663A4306E91E}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C3ACA9F-1B54-4492-8EF2-81BC17BB52A8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C3ACA9F-1B54-4492-8EF2-81BC17BB52A8}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6BE4ACDC-9F9D-49FA-A872-663A4306E91E}\ProgID\ = "takepiece.Set"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F2A9129-4C22-471A-A2E4-AC30AEA37DA9}\2d.0\ = "takepiece"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F2A9129-4C22-471A-A2E4-AC30AEA37DA9}\2d.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F2A9129-4C22-471A-A2E4-AC30AEA37DA9}\2d.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F2A9129-4C22-471A-A2E4-AC30AEA37DA9}\2d.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C3ACA9F-1B54-4492-8EF2-81BC17BB52A8}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6BE4ACDC-9F9D-49FA-A872-663A4306E91E}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C3ACA9F-1B54-4492-8EF2-81BC17BB52A8}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\takepiece.Set\Clsid\ = "{6BE4ACDC-9F9D-49FA-A872-663A4306E91E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C3ACA9F-1B54-4492-8EF2-81BC17BB52A8}\ = "_Set"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C3ACA9F-1B54-4492-8EF2-81BC17BB52A8}\TypeLib\ = "{0F2A9129-4C22-471A-A2E4-AC30AEA37DA9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6BE4ACDC-9F9D-49FA-A872-663A4306E91E}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6BE4ACDC-9F9D-49FA-A872-663A4306E91E}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6BE4ACDC-9F9D-49FA-A872-663A4306E91E}\VERSION	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4540	2964	regsvr32.exe	94
PID 2964 wrote to memory of 4540	2964	regsvr32.exe	94
PID 2964 wrote to memory of 4540	2964	regsvr32.exe	94

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\abc2a78442f1d8448374f86fa41d6ad7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\abc2a78442f1d8448374f86fa41d6ad7.dll
  2⤵
  - Modifies registry class
  PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:1564

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads