68e919c1afa18a156681cdf1cff67dcbdd6eed9a11394bd2af4e96cceed70468

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6ae09030feb3a2f8b807ccd105ac692.dll
Size

65KB
MD5

d6ae09030feb3a2f8b807ccd105ac692
SHA1

dcdee27f0c3a768fe6b938211105c4aaf83f8bb7
SHA256

68e919c1afa18a156681cdf1cff67dcbdd6eed9a11394bd2af4e96cceed70468
SHA512

fef5c787767fe0955b627ecc2d38681e17de977bcab5df0eb4a48526cf3d2ad453ef96df41f874ecbebb6069bdec5bfc5d4bdcd28c0cfe2bec2985b5440bc8a5
SSDEEP

1536:3l9qosETvDsSnMvh/G1cAK8Lcql390i9VXSFO2X:1U8nM5/G1PKacql3eiXXSFO2X

Score

1^/10

Malware Config

Signatures

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ = "hookmir"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\d6ae09030feb3a2f8b807ccd105ac692.classname\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\d6ae09030feb3a2f8b807ccd105ac692.classname\Clsid\ = "{081FE200-A103-11D7-A46D-C770E4459F2F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID\ = "d6ae09030feb3a2f8b807ccd105ac692.classname"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d6ae09030feb3a2f8b807ccd105ac692.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\d6ae09030feb3a2f8b807ccd105ac692.classname	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\d6ae09030feb3a2f8b807ccd105ac692.classname\ = "hookmir"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2208	2216	regsvr32.exe	28
PID 2216 wrote to memory of 2208	2216	regsvr32.exe	28
PID 2216 wrote to memory of 2208	2216	regsvr32.exe	28
PID 2216 wrote to memory of 2208	2216	regsvr32.exe	28
PID 2216 wrote to memory of 2208	2216	regsvr32.exe	28
PID 2216 wrote to memory of 2208	2216	regsvr32.exe	28
PID 2216 wrote to memory of 2208	2216	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d6ae09030feb3a2f8b807ccd105ac692.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d6ae09030feb3a2f8b807ccd105ac692.dll
  2⤵
  - Modifies registry class
  PID:2208

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads