96820541e563ae6bd9e97a0ec95bcbc5e2044dc89574d3c8d0b7b40edc276222

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$SYSDIR/MSSTKPRP.dll
Size

92KB
MD5

d08a99c462298c041139789627168a0b
SHA1

9242e452ce2c8a724be014f1127c23c3c65a7389
SHA256

067beae824a1ff31b73448e00a4c12c7342a679e727c5afb1e3c430df800154c
SHA512

ca7ec8a6fbf377c2d036c73ed927041370c216af44ab864d738178ac716634b5ce58dfaba7ff803e335e41b93720b97194a5d4fc884c3ef68dafe90325573093
SSDEEP

1536:3mUT/oLjE84K7Zrg+PECrpAVdEZ/GbLbYuza/U9snhQvLvDjwgIT:rT/o0u7Zrg+PbpAVdEVGbIH/TnaFIT

Score

1^/10

Malware Config

Signatures

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EBDAAE1-8120-11CF-899F-00AA00688B10}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EBDAAE0-8120-11CF-899F-00AA00688B10}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EBDAAE0-8120-11CF-899F-00AA00688B10}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\MSSTKPRP.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EBDAAE2-8120-11CF-899F-00AA00688B10}\ = "MS Stock Picture Property Page Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EBDAAE2-8120-11CF-899F-00AA00688B10}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EBDAAE1-8120-11CF-899F-00AA00688B10}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EBDAAE1-8120-11CF-899F-00AA00688B10}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EBDAAE1-8120-11CF-899F-00AA00688B10}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EBDAAE2-8120-11CF-899F-00AA00688B10}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EBDAAE1-8120-11CF-899F-00AA00688B10}\ = "MS Stock Color Property Page Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EBDAAE1-8120-11CF-899F-00AA00688B10}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\MSSTKPRP.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EBDAAE0-8120-11CF-899F-00AA00688B10}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EBDAAE2-8120-11CF-899F-00AA00688B10}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EBDAAE2-8120-11CF-899F-00AA00688B10}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EBDAAE2-8120-11CF-899F-00AA00688B10}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\MSSTKPRP.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EBDAAE0-8120-11CF-899F-00AA00688B10}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EBDAAE0-8120-11CF-899F-00AA00688B10}\ = "MS Stock Font Property Page Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7EBDAAE0-8120-11CF-899F-00AA00688B10}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2460	2644	regsvr32.exe	28
PID 2644 wrote to memory of 2460	2644	regsvr32.exe	28
PID 2644 wrote to memory of 2460	2644	regsvr32.exe	28
PID 2644 wrote to memory of 2460	2644	regsvr32.exe	28
PID 2644 wrote to memory of 2460	2644	regsvr32.exe	28
PID 2644 wrote to memory of 2460	2644	regsvr32.exe	28
PID 2644 wrote to memory of 2460	2644	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\MSSTKPRP.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\MSSTKPRP.dll
  2⤵
  - Modifies registry class
  PID:2460

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads