6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06

Analysis

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-03-2024 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06.dll
Size

308KB
MD5

fd431911c3d81505582d94a8012a0010
SHA1

7a3bb1ccd1462eca839a433644f1b549e566b11b
SHA256

6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06
SHA512

de609bf3f30e5f782663f000eab65e3f4c209a536b64afbd543ab1a3a107c18953a2657581d73b156baa560f786f4197e2e5f38755f92ed902f0ec7d031a1c28
SSDEEP

6144:ra8z7NS9Sb15YmbdnpHQGHpU0GP+Bu+wLi109CzUZUwW6c5G2p0riWUY41bwrJRO:FzxSA/JpfHpzz

Score

1^/10

Malware Config

Signatures

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06.ExecuteHookWebPV	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06.ExecuteHookWebPV\ = "Webhook1001PV"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06.ExecuteHookWebPV\Clsid\ = "{A717F661-41D3-11D8-9BD7-962A4BD65539}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\ = "Webhook1001PV"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06.ExecuteHookWebPV\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\ProgID\ = "6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06.ExecuteHookWebPV"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2440	2540	regsvr32.exe	28
PID 2540 wrote to memory of 2440	2540	regsvr32.exe	28
PID 2540 wrote to memory of 2440	2540	regsvr32.exe	28
PID 2540 wrote to memory of 2440	2540	regsvr32.exe	28
PID 2540 wrote to memory of 2440	2540	regsvr32.exe	28
PID 2540 wrote to memory of 2440	2540	regsvr32.exe	28
PID 2540 wrote to memory of 2440	2540	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6c730153a1e1b66393c39c516e23f50aeb756d636da93e9de2e092a18d319b06.dll
  2⤵
  - Modifies registry class
  PID:2440

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads