f0595b6040ec289b66c7d9cf1303d6a9de37956cf3ed3b4ae0e38f7398d7afef

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DBLIST32.dll
Size

195KB
MD5

fae53fad924a437af259649419c806e2
SHA1

ae504aee64256cafa9e704f0be9fc310d31deb75
SHA256

114c72a291f7ac60d74d9f51d5b586915c768a7c19e5412476d0f0db994dd225
SHA512

0259e734c107ae3e58cb39f836539ff31e878db5e2ad66345da862adb8a9ce43ae3fb499f6301b2615e3d6c4af43896a969a7d54adf6e4af815b02b1288399b5
SSDEEP

6144:5TUF/tp4hc66qvBaHLldRqVAPX8lHAYN0:5egh8qJaJdRqVfOY0

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D0E0AA20-3082-11CF-AEBE-00AA00A8F7F3}\ = "DBList General Property Page Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBCtls.DBCombo.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAEEE763-117E-101B-8933-08002B2F4F5A}\1.1\HELPDIR\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FAEEE762-117E-101B-8933-08002B2F4F5A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBCtls.DBList\ = "Microsoft DBList Control, version 6.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB39D9A0-557A-11CF-AEBE-00AA00A8F7F3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09194000-DF6E-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{09194002-DF6E-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\Required Categories\{426CD130-00FC-11D0-9454-00A0C91110ED}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{09194000-DF6E-11CF-8E74-00A0C90F26F8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{02A69B02-081B-101B-8933-08002B2F4F5A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{09194002-DF6E-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\VersionIndependentProgID\ = "MSDBCtls.DBList"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DBLIST32.dll, 2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\TypeLib\ = "{FAEEE763-117E-101B-8933-08002B2F4F5A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{09194000-DF6E-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09194000-DF6E-11CF-8E74-00A0C90F26F8}\ = "IDBList"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09194000-DF6E-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{02A69B02-081B-101B-8933-08002B2F4F5A}\ = "DDBListEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FAEEE762-117E-101B-8933-08002B2F4F5A}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBCtls.DBList.1\ = "Microsoft DBList Control, version 6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\TypeLib\ = "{FAEEE763-117E-101B-8933-08002B2F4F5A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAEEE763-117E-101B-8933-08002B2F4F5A}\1.1\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DBLIST32.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02A69B02-081B-101B-8933-08002B2F4F5A}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FAEEE762-117E-101B-8933-08002B2F4F5A}\TypeLib\ = "{FAEEE763-117E-101B-8933-08002B2F4F5A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAEEE763-117E-101B-8933-08002B2F4F5A}\1.1\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\ = "{FAEEE763-117E-101B-8933-08002B2F4F5A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\Required Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{02A69B02-081B-101B-8933-08002B2F4F5A}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02A69B02-081B-101B-8933-08002B2F4F5A}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FAEEE762-117E-101B-8933-08002B2F4F5A}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DBLIST32.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBCtls.DBList\CurVer\ = "MSDBCtls.DBList.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\MiscStatus\1\ = "131473"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\VersionIndependentProgID\ = "MSDBCtls.DBCombo"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{09194000-DF6E-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{FAEEE763-117E-101B-8933-08002B2F4F5A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02A69B02-081B-101B-8933-08002B2F4F5A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02A69B02-081B-101B-8933-08002B2F4F5A}\TypeLib\ = "{FAEEE763-117E-101B-8933-08002B2F4F5A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09194002-DF6E-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBCtls.DBList.1\CLSID\ = "{02A69B00-081B-101B-8933-08002B2F4F5A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DBLIST32.dll, 1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D0E0AA20-3082-11CF-AEBE-00AA00A8F7F3}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FAEEE762-117E-101B-8933-08002B2F4F5A}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBCtls.DBList	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2060	2272	regsvr32.exe	28
PID 2272 wrote to memory of 2060	2272	regsvr32.exe	28
PID 2272 wrote to memory of 2060	2272	regsvr32.exe	28
PID 2272 wrote to memory of 2060	2272	regsvr32.exe	28
PID 2272 wrote to memory of 2060	2272	regsvr32.exe	28
PID 2272 wrote to memory of 2060	2272	regsvr32.exe	28
PID 2272 wrote to memory of 2060	2272	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\DBLIST32.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\DBLIST32.dll
  2⤵
  - Modifies registry class
  PID:2060

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads