91982198e022b03653ab910038b80c203a4359079ebc0218066afbbf2dca52a9

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91982198e022b03653ab910038b80c203a4359079ebc0218066afbbf2dca52a9.dll
Size

804KB
MD5

731f07dbd6afcfc42d51302aa0428fee
SHA1

eee16c589f159fa0ce107fc9ac4b5cdd7b754de8
SHA256

91982198e022b03653ab910038b80c203a4359079ebc0218066afbbf2dca52a9
SHA512

18bfc1d3985cf6e3621fb5402d752f7d469099699b05324324d6aac0fa2b60ef94815b5a295de49cc109651c643b938914dc713c608fdbf38686edf8e352137c
SSDEEP

3072:/rw0XWPrCMplVhFdhRdkP4Ms6odq7r5DSCFS9d5yzVsJrw2Rn:/UBPB3FDPkP4MX4yr5DSWSGVsJE+

Score

1^/10

Malware Config

Signatures

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}\6d.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\ = "_Scripts"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\ProgID\ = "eCrash_DBUpd.Scripts"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}\6d.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}\6d.0\ = "eCrash Database Update Component"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}\6d.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\VERSION\ = "109.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}\6d.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\TypeLib\Version = "6d.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\TypeLib\ = "{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\VERSION	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\ = "Scripts"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}\6d.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\91982198e022b03653ab910038b80c203a4359079ebc0218066afbbf2dca52a9.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}\6d.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\TypeLib\Version = "6d.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\ = "eCrash_DBUpd.Scripts"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\91982198e022b03653ab910038b80c203a4359079ebc0218066afbbf2dca52a9.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eCrash_DBUpd.Scripts	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}\6d.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\ = "_Scripts"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\TypeLib\ = "{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eCrash_DBUpd.Scripts\ = "eCrash_DBUpd.Scripts"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eCrash_DBUpd.Scripts\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}\6d.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\TypeLib\ = "{BAAD1A31-9886-48E8-91C4-BEA23D2B0A2F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eCrash_DBUpd.Scripts\Clsid\ = "{79CA96B3-C9B1-4BDD-A71E-85EDD1A3E237}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DD19673-5C93-4C62-81D7-75031C768BFA}\ProxyStubClsid	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2220	2352	regsvr32.exe	28
PID 2352 wrote to memory of 2220	2352	regsvr32.exe	28
PID 2352 wrote to memory of 2220	2352	regsvr32.exe	28
PID 2352 wrote to memory of 2220	2352	regsvr32.exe	28
PID 2352 wrote to memory of 2220	2352	regsvr32.exe	28
PID 2352 wrote to memory of 2220	2352	regsvr32.exe	28
PID 2352 wrote to memory of 2220	2352	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\91982198e022b03653ab910038b80c203a4359079ebc0218066afbbf2dca52a9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\91982198e022b03653ab910038b80c203a4359079ebc0218066afbbf2dca52a9.dll
  2⤵
  - Modifies registry class
  PID:2220

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads