768de981742cf716ad560f61774625cebfc3fc9c4c7f7ed1d55e50d05a9517d3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 20:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

prjYongsu.dll
Size

2.8MB
MD5

f39cca1894f062d4caad52d91f18e31c
SHA1

329ebdb6d24e4dfda5877c2e042b5bb5162590f4
SHA256

a5a2c68203cbe2d1937fea249568b7de6e853929bdc80703a59a1da93cad7425
SHA512

f522e8a1e8fae59374b4722997de0ee372b9a729b1bdb2983569219995212ac79bdb5523067a0cc27b0b0a2eb72be031242966122312b193ef2279cb8c1b8661
SSDEEP

24576:NArLNTyrLAKTuVONlYeyEL+PhViM0Rji7v+qpzOCr6RP:NITyrLjoOweD+PhVinu7mqpzOCr6RP

Score

1^/10

Malware Config

Signatures

Modifies registry class 44 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{15C409AC-76DF-4137-A489-402BA1412C24}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{752E9640-121A-4879-B3BB-CABE41641281}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{26DCD203-5A67-4D39-8419-A039470C372B}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{15C409AC-76DF-4137-A489-402BA1412C24}\ = "_clsVill"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{15C409AC-76DF-4137-A489-402BA1412C24}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{752E9640-121A-4879-B3BB-CABE41641281}\ProgID\ = "prjYongsu.clsVill"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{752E9640-121A-4879-B3BB-CABE41641281}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{26DCD203-5A67-4D39-8419-A039470C372B}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{752E9640-121A-4879-B3BB-CABE41641281}\ = "prjYongsu.clsVill"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{752E9640-121A-4879-B3BB-CABE41641281}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{26DCD203-5A67-4D39-8419-A039470C372B}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{15C409AC-76DF-4137-A489-402BA1412C24}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{15C409AC-76DF-4137-A489-402BA1412C24}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{15C409AC-76DF-4137-A489-402BA1412C24}\TypeLib\ = "{26DCD203-5A67-4D39-8419-A039470C372B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{15C409AC-76DF-4137-A489-402BA1412C24}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{26DCD203-5A67-4D39-8419-A039470C372B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{26DCD203-5A67-4D39-8419-A039470C372B}\1.0\ = "prjYongsu"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{26DCD203-5A67-4D39-8419-A039470C372B}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{15C409AC-76DF-4137-A489-402BA1412C24}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{752E9640-121A-4879-B3BB-CABE41641281}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{15C409AC-76DF-4137-A489-402BA1412C24}\ = "_clsVill"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{752E9640-121A-4879-B3BB-CABE41641281}\TypeLib\ = "{26DCD203-5A67-4D39-8419-A039470C372B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\prjYongsu.clsVill\ = "prjYongsu.clsVill"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{752E9640-121A-4879-B3BB-CABE41641281}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\prjYongsu.clsVill\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\prjYongsu.clsVill\Clsid\ = "{752E9640-121A-4879-B3BB-CABE41641281}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{15C409AC-76DF-4137-A489-402BA1412C24}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{15C409AC-76DF-4137-A489-402BA1412C24}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{752E9640-121A-4879-B3BB-CABE41641281}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{15C409AC-76DF-4137-A489-402BA1412C24}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{15C409AC-76DF-4137-A489-402BA1412C24}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{15C409AC-76DF-4137-A489-402BA1412C24}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{15C409AC-76DF-4137-A489-402BA1412C24}\TypeLib\ = "{26DCD203-5A67-4D39-8419-A039470C372B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{752E9640-121A-4879-B3BB-CABE41641281}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{752E9640-121A-4879-B3BB-CABE41641281}\VERSION\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{15C409AC-76DF-4137-A489-402BA1412C24}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{15C409AC-76DF-4137-A489-402BA1412C24}\ = "clsVill"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{26DCD203-5A67-4D39-8419-A039470C372B}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{26DCD203-5A67-4D39-8419-A039470C372B}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\prjYongsu.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{26DCD203-5A67-4D39-8419-A039470C372B}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\prjYongsu.clsVill	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{26DCD203-5A67-4D39-8419-A039470C372B}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{752E9640-121A-4879-B3BB-CABE41641281}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{752E9640-121A-4879-B3BB-CABE41641281}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\prjYongsu.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2924	2872	regsvr32.exe	28
PID 2872 wrote to memory of 2924	2872	regsvr32.exe	28
PID 2872 wrote to memory of 2924	2872	regsvr32.exe	28
PID 2872 wrote to memory of 2924	2872	regsvr32.exe	28
PID 2872 wrote to memory of 2924	2872	regsvr32.exe	28
PID 2872 wrote to memory of 2924	2872	regsvr32.exe	28
PID 2872 wrote to memory of 2924	2872	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\prjYongsu.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\prjYongsu.dll
  2⤵
  - Modifies registry class
  PID:2924

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads