860ab461cf4a1228ed2bd4bbe7c23ac806bd0998581a5a3d2d5a096a2b71c3fd

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/03/2024, 05:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirtualWall.dll
Size 310KB
Sample240304-ggf5qscc75
SHA256 dad8f06df5c8417d1c43fe645d0425ce2369c61a50ed56b63c0fc472cdb8bbfd
MD5 74b11daf83e0e41821e3907afe228737
SHA1 38847d90b9117d9527fc65b878c49888b7b16eed
SHA512 e4d1870e4b9a1bc1051379015fa53a3b5a8a7a0286d513b0d6b53dd16193f7f83aa55cea218ce0d1a65dbc66f8b28e3684d03aed6097792877db2dec230f12e8
SSDEEP 6144:5z7pa09Ih48wScQMFUMK4wBgFb1TLdLb7IOerqmo+Vlw2Y:5np39IO1QFMvwmb1TLJbJeemXVm
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualWall.Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DDDD540-D2BA-444E-A4BF-E7F228672E7F}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3C82F00-B5E2-4B0D-8E92-686898B8EB48}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3C82F00-B5E2-4B0D-8E92-686898B8EB48}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3C82F00-B5E2-4B0D-8E92-686898B8EB48}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B7818D30-AAF3-4D58-B39D-3A2C12680D74}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B7818D30-AAF3-4D58-B39D-3A2C12680D74}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualWall.Control.1\ = "Control Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualWall.Control.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DDDD540-D2BA-444E-A4BF-E7F228672E7F}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DDDD540-D2BA-444E-A4BF-E7F228672E7F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VirtualWall.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3C82F00-B5E2-4B0D-8E92-686898B8EB48}\1.0\ = "VirtualWall 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3C82F00-B5E2-4B0D-8E92-686898B8EB48}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B7818D30-AAF3-4D58-B39D-3A2C12680D74}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualWall.Control\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DDDD540-D2BA-444E-A4BF-E7F228672E7F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DDDD540-D2BA-444E-A4BF-E7F228672E7F}\TypeLib\ = "{F3C82F00-B5E2-4B0D-8E92-686898B8EB48}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B7818D30-AAF3-4D58-B39D-3A2C12680D74}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7818D30-AAF3-4D58-B39D-3A2C12680D74}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7818D30-AAF3-4D58-B39D-3A2C12680D74}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7818D30-AAF3-4D58-B39D-3A2C12680D74}\TypeLib\ = "{F3C82F00-B5E2-4B0D-8E92-686898B8EB48}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualWall.Control\CLSID\ = "{7DDDD540-D2BA-444E-A4BF-E7F228672E7F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualWall.Control\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualWall.Control\CurVer\ = "VirtualWall.Control.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DDDD540-D2BA-444E-A4BF-E7F228672E7F}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3C82F00-B5E2-4B0D-8E92-686898B8EB48}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3C82F00-B5E2-4B0D-8E92-686898B8EB48}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7818D30-AAF3-4D58-B39D-3A2C12680D74}\ = "IControl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7818D30-AAF3-4D58-B39D-3A2C12680D74}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualWall.Control.1\CLSID\ = "{7DDDD540-D2BA-444E-A4BF-E7F228672E7F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DDDD540-D2BA-444E-A4BF-E7F228672E7F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DDDD540-D2BA-444E-A4BF-E7F228672E7F}\VersionIndependentProgID\ = "VirtualWall.Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3C82F00-B5E2-4B0D-8E92-686898B8EB48}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3C82F00-B5E2-4B0D-8E92-686898B8EB48}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VirtualWall.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DDDD540-D2BA-444E-A4BF-E7F228672E7F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DDDD540-D2BA-444E-A4BF-E7F228672E7F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3C82F00-B5E2-4B0D-8E92-686898B8EB48}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B7818D30-AAF3-4D58-B39D-3A2C12680D74}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7818D30-AAF3-4D58-B39D-3A2C12680D74}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualWall.Control.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B7818D30-AAF3-4D58-B39D-3A2C12680D74}\TypeLib\ = "{F3C82F00-B5E2-4B0D-8E92-686898B8EB48}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7818D30-AAF3-4D58-B39D-3A2C12680D74}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualWall.Control\ = "Control Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DDDD540-D2BA-444E-A4BF-E7F228672E7F}\ = "Control Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DDDD540-D2BA-444E-A4BF-E7F228672E7F}\ProgID\ = "VirtualWall.Control.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B7818D30-AAF3-4D58-B39D-3A2C12680D74}\ = "IControl"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3044	3036	regsvr32.exe	28
PID 3036 wrote to memory of 3044	3036	regsvr32.exe	28
PID 3036 wrote to memory of 3044	3036	regsvr32.exe	28
PID 3036 wrote to memory of 3044	3036	regsvr32.exe	28
PID 3036 wrote to memory of 3044	3036	regsvr32.exe	28
PID 3036 wrote to memory of 3044	3036	regsvr32.exe	28
PID 3036 wrote to memory of 3044	3036	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\VirtualWall.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\VirtualWall.dll
  2⤵
  - Modifies registry class
  PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-0-0x0000000010000000-0x0000000010078000-memory.dmp

Download

memory/3044-1-0x0000000000850000-0x000000000089C000-memory.dmp

Download

memory/3044-2-0x0000000002B40000-0x0000000002B43000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads