f0595b6040ec289b66c7d9cf1303d6a9de37956cf3ed3b4ae0e38f7398d7afef

Analysis

max time kernel
147s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DBGRID32.dll
Size

507KB
MD5

f3e5afb3436e22ad2ffec89b386532ee
SHA1

ebad400949b524e273435f2717b1aadfe7c9ede7
SHA256

5717b5ff540ab2af539f2bcd2fcfc1b00da8c32ed4f4c290de7467da31a657ce
SHA512

8e009ec7b668aa35986115d770ba6d61879ad235b78b6980cbd9305439a83d2e12f66423633e9caabff535d92ff56c53334726284062bdb939e649525bb41511
SSDEEP

6144:jtBFDh0ce7r4+RATQCBdFWBOsMGHzfuALLcyUdZ5ppz0oqhnLzyvbpcYl3g:j1d0D7r41RDFWBOsMGHzft4yUdMpRY

Score

1^/10

Malware Config

Signatures

Modifies registry class 60 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C04-0000-0000-0000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0\0\win32\ = "C:\\USERS\\ADMIN\\APPDATA\\LOCAL\\TEMP\\DBGRID32.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C03-0000-0000-0000-000000000046}\ = "DBGrid Property Page 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C04-0000-0000-0000-000000000046}\ = "DBGrid Property Page 3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0\FLAGS\ = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C03-0000-0000-0000-000000000046}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C0D-0000-0000-0000-000000000046}\InprocServer32\ = "C:\\USERS\\ADMIN\\APPDATA\\LOCAL\\TEMP\\DBGRID32.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C0E-0000-0000-0000-000000000046}\ = "DBGrid Property Page 4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBGrid.DBGrid\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C04-0000-0000-0000-000000000046}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C0D-0000-0000-0000-000000000046}\ = "DBGrid Property Page 2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBGrid.DBGrid\ = "DBGrid Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0\ = "Microsoft Data Bound Grid Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C0E-0000-0000-0000-000000000046}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C08-0000-0000-0000-000000000046}\ = "DBGrid Property Page 5"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\InprocServer32\ = "C:\\USERS\\ADMIN\\APPDATA\\LOCAL\\TEMP\\DBGRID32.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C0D-0000-0000-0000-000000000046}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C04-0000-0000-0000-000000000046}\InprocServer32\ = "C:\\USERS\\ADMIN\\APPDATA\\LOCAL\\TEMP\\DBGRID32.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C08-0000-0000-0000-000000000046}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\ProgID\ = "MSDBGrid.DBGrid"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C03-0000-0000-0000-000000000046}\InprocServer32\ = "C:\\USERS\\ADMIN\\APPDATA\\LOCAL\\TEMP\\DBGRID32.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\ToolboxBitmap32\ = "C:\\USERS\\ADMIN\\APPDATA\\LOCAL\\TEMP\\DBGRID32.DLL, 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\MiscStatus\1\ = "164241"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C03-0000-0000-0000-000000000046}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0\HELPDIR\ = "C:\\USERS\\ADMIN\\APPDATA\\LOCAL\\TEMP"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C0D-0000-0000-0000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C08-0000-0000-0000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\TypeLib\ = "{00028C01-0000-0000-0000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C0E-0000-0000-0000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBGrid.DBGrid\CLSID\ = "{00028C00-0000-0000-0000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Required Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Required Categories\{426CD130-00FC-11D0-9454-00A0C91110ED}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C0E-0000-0000-0000-000000000046}\InprocServer32\ = "C:\\USERS\\ADMIN\\APPDATA\\LOCAL\\TEMP\\DBGRID32.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBGrid.DBGrid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C08-0000-0000-0000-000000000046}\InprocServer32\ = "C:\\USERS\\ADMIN\\APPDATA\\LOCAL\\TEMP\\DBGRID32.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\ = "DBGrid Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Version\ = "1.0"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 4892	3696	regsvr32.exe	88
PID 3696 wrote to memory of 4892	3696	regsvr32.exe	88
PID 3696 wrote to memory of 4892	3696	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\DBGRID32.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\DBGRID32.dll
  2⤵
  - Modifies registry class
  PID:4892

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads