84fd236a407f362961387006def2f4e20d5b02c16cabaf12af0ce92806a4157a

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 23:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

84fd236a407f362961387006def2f4e20d5b02c16cabaf12af0ce92806a4157a.dll
Size

122KB
MD5

db39121019131b07e9da1ea28d889f28
SHA1

11bdbd5ffd13124c9da18686504eef14e7dec1ee
SHA256

84fd236a407f362961387006def2f4e20d5b02c16cabaf12af0ce92806a4157a
SHA512

5b1ad78d30348a2493eb78a1dbe68d841aed271a7670a83e168902769b7a63773b20b0c15e3cf2bc5bc4c0d7822c8d2c3de8d8a479ce828d1405cdc38705fd52
SSDEEP

3072:Q6PaJ/mY4KbCzzIhCpqvKV+Gj0d08F5mgsi:QgpKEEDvLK0W8F8i

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A13AD8A-D35E-4F3D-AF3D-DB675AE3189C}\TypeLib\ = "{C293B395-21A4-4A51-B336-9CE2607F1C82}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D50B34E7-B447-4971-B48B-FBFA66152803}\TypeLib\ = "{C293B395-21A4-4A51-B336-9CE2607F1C82}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{998B0D85-C774-412f-84C7-4DC436C2B7A5}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A13AD8A-D35E-4F3D-AF3D-DB675AE3189C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BCF85B43-4B07-432D-87E9-B3BD03E718F0}\TypeLib\ = "{C293B395-21A4-4A51-B336-9CE2607F1C82}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8BE52B68-AE6F-4967-B9D2-3EB45430519A}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WizChain.PropertyPagePropertyBag.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A13AD8A-D35E-4F3D-AF3D-DB675AE3189C}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BCF85B43-4B07-432D-87E9-B3BD03E718F0}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F651184C-B307-46B0-B70D-6523E8A35B8F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WizChain.ChainWiz.1\CLSID\ = "{998B0D85-C774-412f-84C7-4DC436C2B7A5}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C293B395-21A4-4A51-B336-9CE2607F1C82}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{88AC4986-A081-4b3f-B41D-6F41AC28F28D}\ProgID\ = "Wizchain.StatusProgress.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{220EC9FD-7E3C-4009-B937-E1ADBC680E29}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wizchain.StatusProgress\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8BE52B68-AE6F-4967-B9D2-3EB45430519A}\ = "IStatusDlg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{23DF902F-A644-4471-910D-76FBD66B8AAC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D50B34E7-B447-4971-B48B-FBFA66152803}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{712C8598-F517-4d4a-A327-ABA6C6110B90}\ = "PropertyPagePropertyBag Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{16E6BADC-4036-48c8-A163-88FC9BBCBC57}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{23DF902F-A644-4471-910D-76FBD66B8AAC}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCF85B43-4B07-432D-87E9-B3BD03E718F0}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D50B34E7-B447-4971-B48B-FBFA66152803}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WizChain.WizardScriptingEngine.1\ = "WizardScriptingEngine Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{220EC9FD-7E3C-4009-B937-E1ADBC680E29}\ProgID\ = "WizChain.StatusDlg.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{712C8598-F517-4d4a-A327-ABA6C6110B90}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{220EC9FD-7E3C-4009-B937-E1ADBC680E29}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wizchain.StatusProgress\CurVer\ = "Wizchain.StatusProgress.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BCF85B43-4B07-432D-87E9-B3BD03E718F0}\ = "IPropertyCollection"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D50B34E7-B447-4971-B48B-FBFA66152803}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WizChain.ChainWiz.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8BE52B68-AE6F-4967-B9D2-3EB45430519A}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F651184C-B307-46B0-B70D-6523E8A35B8F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{16E6BADC-4036-48c8-A163-88FC9BBCBC57}\VersionIndependentProgID\ = "WizChain.WizardScriptingEngine"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{16E6BADC-4036-48c8-A163-88FC9BBCBC57}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{88AC4986-A081-4b3f-B41D-6F41AC28F28D}\ = "StatusProgress Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{998B0D85-C774-412f-84C7-4DC436C2B7A5}\TypeLib\ = "{C293B395-21A4-4a51-B336-9CE2607F1C82}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BCF85B43-4B07-432D-87E9-B3BD03E718F0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wizchain.StatusProgress	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8BE52B68-AE6F-4967-B9D2-3EB45430519A}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WizChain.PropertyPagePropertyBag\ = "PropertyPagePropertyBag Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{16E6BADC-4036-48c8-A163-88FC9BBCBC57}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WizChain.WizardScriptingEngine\ = "WizardScriptingEngine Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCF85B43-4B07-432D-87E9-B3BD03E718F0}\TypeLib\ = "{C293B395-21A4-4A51-B336-9CE2607F1C82}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{16E6BADC-4036-48c8-A163-88FC9BBCBC57}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\84fd236a407f362961387006def2f4e20d5b02c16cabaf12af0ce92806a4157a.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C293B395-21A4-4A51-B336-9CE2607F1C82}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wizchain.StatusProgress.1\CLSID\ = "{88AC4986-A081-4b3f-B41D-6F41AC28F28D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A13AD8A-D35E-4F3D-AF3D-DB675AE3189C}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WizChain.StatusDlg\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A13AD8A-D35E-4F3D-AF3D-DB675AE3189C}\ = "IWizardScriptingEngine"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{220EC9FD-7E3C-4009-B937-E1ADBC680E29}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A13AD8A-D35E-4F3D-AF3D-DB675AE3189C}\ = "IWizardScriptingEngine"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WizChain.WizardScriptingEngine.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{16E6BADC-4036-48c8-A163-88FC9BBCBC57}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C293B395-21A4-4A51-B336-9CE2607F1C82}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\84fd236a407f362961387006def2f4e20d5b02c16cabaf12af0ce92806a4157a.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8BE52B68-AE6F-4967-B9D2-3EB45430519A}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{23DF902F-A644-4471-910D-76FBD66B8AAC}\TypeLib\ = "{C293B395-21A4-4A51-B336-9CE2607F1C82}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{23DF902F-A644-4471-910D-76FBD66B8AAC}\ = "IPropertyPagePropertyBag"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8BE52B68-AE6F-4967-B9D2-3EB45430519A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{88AC4986-A081-4b3f-B41D-6F41AC28F28D}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCF85B43-4B07-432D-87E9-B3BD03E718F0}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WizChain.ChainWiz\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{23DF902F-A644-4471-910D-76FBD66B8AAC}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F651184C-B307-46B0-B70D-6523E8A35B8F}\ = "IPropertyItem"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2192	2176	regsvr32.exe	28
PID 2176 wrote to memory of 2192	2176	regsvr32.exe	28
PID 2176 wrote to memory of 2192	2176	regsvr32.exe	28
PID 2176 wrote to memory of 2192	2176	regsvr32.exe	28
PID 2176 wrote to memory of 2192	2176	regsvr32.exe	28
PID 2176 wrote to memory of 2192	2176	regsvr32.exe	28
PID 2176 wrote to memory of 2192	2176	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\84fd236a407f362961387006def2f4e20d5b02c16cabaf12af0ce92806a4157a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\84fd236a407f362961387006def2f4e20d5b02c16cabaf12af0ce92806a4157a.dll
  2⤵
  - Modifies registry class
  PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-0-0x0000000000170000-0x0000000000191000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads