52390a0ceb163b4bb333377a6a9b3a294b7a9dd3105940a2ef6c911f233b1255

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cb92df78982cd200830c3463baba29a4.dll
Size

9KB
MD5

cb92df78982cd200830c3463baba29a4
SHA1

005c3a7e45546a34a542572a31c9c5d08cdc66bd
SHA256

52390a0ceb163b4bb333377a6a9b3a294b7a9dd3105940a2ef6c911f233b1255
SHA512

e4f7c468420a251c5cffee9138d33e96b2e2a63e8a46655b31d74e055d86d646f30432c32dd2d58f343d885ecc91a1ce4d80a753205fa776db6b4e238aac97a9
SSDEEP

96:c6wrtZhW6XmUL+iu+GxN8Hf8Mu6XKHMz7JAOAeoLDPa4ywAnzP7nK7kNubdR:Xs8gL+WLnas/uOAe4Pj77kNupR

Score

1^/10

Malware Config

Signatures

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C2DDA92-840E-4C47-A209-A7F51CCA535E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C2DDA92-840E-4C47-A209-A7F51CCA535E}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3040DD03-9C5A-4563-AC2E-0026188C25A9}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{47FC238F-C142-4D8C-A052-DBEEEC4AC7C3}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cb92df78982cd200830c3463baba29a4.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C2DDA92-840E-4C47-A209-A7F51CCA535E}\ = "IComDll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3040DD03-9C5A-4563-AC2E-0026188C25A9}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3040DD03-9C5A-4563-AC2E-0026188C25A9}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ComDll.1\ = "Colib for lazy guys"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComDll.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{47FC238F-C142-4D8C-A052-DBEEEC4AC7C3}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3040DD03-9C5A-4563-AC2E-0026188C25A9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3040DD03-9C5A-4563-AC2E-0026188C25A9}\InprocServer32\ThreadingModel = "both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3040DD03-9C5A-4563-AC2E-0026188C25A9}\ProgID\ = "ComDll.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ComDll\CurVer\ = "ComDll.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{47FC238F-C142-4D8C-A052-DBEEEC4AC7C3}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{47FC238F-C142-4D8C-A052-DBEEEC4AC7C3}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C2DDA92-840E-4C47-A209-A7F51CCA535E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C2DDA92-840E-4C47-A209-A7F51CCA535E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3040DD03-9C5A-4563-AC2E-0026188C25A9}\TypeLib\ = "{47FC238F-C142-4D8C-A052-DBEEEC4AC7C3}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3040DD03-9C5A-4563-AC2E-0026188C25A9}\VersionIndependentProgID\ = "ComDll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComDll	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C2DDA92-840E-4C47-A209-A7F51CCA535E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComDll\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{47FC238F-C142-4D8C-A052-DBEEEC4AC7C3}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{47FC238F-C142-4D8C-A052-DBEEEC4AC7C3}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C2DDA92-840E-4C47-A209-A7F51CCA535E}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C2DDA92-840E-4C47-A209-A7F51CCA535E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3040DD03-9C5A-4563-AC2E-0026188C25A9}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3040DD03-9C5A-4563-AC2E-0026188C25A9}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ComDll\ = "Colib for lazy guys"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C2DDA92-840E-4C47-A209-A7F51CCA535E}\TypeLib\ = "{47FC238F-C142-4D8C-A052-DBEEEC4AC7C3}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C2DDA92-840E-4C47-A209-A7F51CCA535E}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C2DDA92-840E-4C47-A209-A7F51CCA535E}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComDll.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ComDll.1\CLSID\ = "{3040DD03-9C5A-4563-AC2E-0026188C25A9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{47FC238F-C142-4D8C-A052-DBEEEC4AC7C3}\1.0\ = "Server 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{47FC238F-C142-4D8C-A052-DBEEEC4AC7C3}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C2DDA92-840E-4C47-A209-A7F51CCA535E}\TypeLib\ = "{47FC238F-C142-4D8C-A052-DBEEEC4AC7C3}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3040DD03-9C5A-4563-AC2E-0026188C25A9}\ = "Colib for lazy guys"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3040DD03-9C5A-4563-AC2E-0026188C25A9}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{47FC238F-C142-4D8C-A052-DBEEEC4AC7C3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C2DDA92-840E-4C47-A209-A7F51CCA535E}\ = "IComDll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3040DD03-9C5A-4563-AC2E-0026188C25A9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cb92df78982cd200830c3463baba29a4.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{47FC238F-C142-4D8C-A052-DBEEEC4AC7C3}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C2DDA92-840E-4C47-A209-A7F51CCA535E}\TypeLib	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 972	2980	regsvr32.exe	85
PID 2980 wrote to memory of 972	2980	regsvr32.exe	85
PID 2980 wrote to memory of 972	2980	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cb92df78982cd200830c3463baba29a4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cb92df78982cd200830c3463baba29a4.dll
  2⤵
  - Modifies registry class
  PID:972

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads