cd956286dc3584715de9139f38e679d38a8b8e80d772124da3c447248b9ba3a1

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RegDll.bat
Size

22B
MD5

4f2c6ae80db196bbe043253ac2bc0f6c
SHA1

d5fad6ddcbc14fef809793b5e6a3aae04d610847
SHA256

6d3a77fd2391f683212677d072b525058db0aea47a12e200d274a24300fb0f66
SHA512

149fd43b186fce266b7951b5f4b3af06ccf2b90a6889d07264afc37a8933705cc7b57b639850184b8049f84636cfbffd94b75bd87f2a9fbed330765452582a57

Score

1^/10

Malware Config

Signatures

Modifies registry class 50 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SimpleExt.SimpleShlExt\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5E2121E1-0300-11D4-8D3B-444553550000}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GFTPpro.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5E2121E1-0300-11D4-8D3B-444553550000}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5E2121ED-0300-11D4-8D3B-444553550000}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E2121ED-0300-11D4-8D3B-444553550000}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SimpleExt.SimpleShlExt.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SimpleExt.SimpleShlExt.1\CLSID\ = "{5E2121EE-0300-11D4-8D3B-444553550000}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5E2121E1-0300-11D4-8D3B-444553550000}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5E2121ED-0300-11D4-8D3B-444553550000}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SimpleExt.SimpleShlExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5E2121ED-0300-11D4-8D3B-444553550000}\ = "ISimpleShlExt"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5E2121E1-0300-11D4-8D3B-444553550000}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5E2121E1-0300-11D4-8D3B-444553550000}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SimpleExt.SimpleShlExt\ = "SimpleShlExt Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SimpleExt.SimpleShlExt\CLSID\ = "{5E2121EE-0300-11D4-8D3B-444553550000}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SimpleExt.SimpleShlExt\CurVer\ = "SimpleExt.SimpleShlExt.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E2121EE-0300-11D4-8D3B-444553550000}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E2121EE-0300-11D4-8D3B-444553550000}\TypeLib\ = "{5E2121E1-0300-11D4-8D3B-444553550000}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SimpleExt.SimpleShlExt.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5E2121E1-0300-11D4-8D3B-444553550000}\1.0\ = "SimpleExt 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5E2121E1-0300-11D4-8D3B-444553550000}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\SimpleShlExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SimpleShlExt\ = "{5E2121EE-0300-11D4-8D3B-444553550000}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SimpleExt.SimpleShlExt\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E2121EE-0300-11D4-8D3B-444553550000}\ = "SimpleShlExt Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E2121EE-0300-11D4-8D3B-444553550000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5E2121E1-0300-11D4-8D3B-444553550000}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E2121ED-0300-11D4-8D3B-444553550000}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5E2121ED-0300-11D4-8D3B-444553550000}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5E2121ED-0300-11D4-8D3B-444553550000}\TypeLib\ = "{5E2121E1-0300-11D4-8D3B-444553550000}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E2121ED-0300-11D4-8D3B-444553550000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SimpleExt.SimpleShlExt.1\ = "SimpleShlExt Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E2121EE-0300-11D4-8D3B-444553550000}\VersionIndependentProgID\ = "SimpleExt.SimpleShlExt"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E2121EE-0300-11D4-8D3B-444553550000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GFTPpro.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E2121EE-0300-11D4-8D3B-444553550000}\ProgID\ = "SimpleExt.SimpleShlExt.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E2121EE-0300-11D4-8D3B-444553550000}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E2121EE-0300-11D4-8D3B-444553550000}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\SimpleShlExt\ = "{5E2121EE-0300-11D4-8D3B-444553550000}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5E2121ED-0300-11D4-8D3B-444553550000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E2121ED-0300-11D4-8D3B-444553550000}\ = "ISimpleShlExt"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E2121EE-0300-11D4-8D3B-444553550000}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E2121EE-0300-11D4-8D3B-444553550000}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E2121ED-0300-11D4-8D3B-444553550000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SimpleShlExt	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5E2121E1-0300-11D4-8D3B-444553550000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5E2121E1-0300-11D4-8D3B-444553550000}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5E2121ED-0300-11D4-8D3B-444553550000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E2121ED-0300-11D4-8D3B-444553550000}\TypeLib\ = "{5E2121E1-0300-11D4-8D3B-444553550000}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5E2121EE-0300-11D4-8D3B-444553550000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E2121ED-0300-11D4-8D3B-444553550000}\ProxyStubClsid32	regsvr32.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1808	regsvr32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1808	1132	cmd.exe	29
PID 1132 wrote to memory of 1808	1132	cmd.exe	29
PID 1132 wrote to memory of 1808	1132	cmd.exe	29
PID 1132 wrote to memory of 1808	1132	cmd.exe	29
PID 1132 wrote to memory of 1808	1132	cmd.exe	29
PID 1808 wrote to memory of 1284	1808	regsvr32.exe	30
PID 1808 wrote to memory of 1284	1808	regsvr32.exe	30
PID 1808 wrote to memory of 1284	1808	regsvr32.exe	30
PID 1808 wrote to memory of 1284	1808	regsvr32.exe	30
PID 1808 wrote to memory of 1284	1808	regsvr32.exe	30
PID 1808 wrote to memory of 1284	1808	regsvr32.exe	30
PID 1808 wrote to memory of 1284	1808	regsvr32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\RegDll.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\system32\regsvr32.exe
  regsvr32 GFTPpro.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\SysWOW64\regsvr32.exe
    GFTPpro.dll
    3⤵
    - Modifies registry class
    PID:1284

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads