221e8ed761bb45fb42c5a53b0fb1a2dd44c08766a48d5b0435507d5d198f0cac

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DBGRID32.dll
Size

513KB
MD5

ec2f4fce368dade257d89a1bde1de380
SHA1

7026e068eaaa6c46a29d1cbf50b057a1744d67ce
SHA256

6cc3e18193118e5d5e0d9a3c765ff2e649a99641b55a79abf1463ed5d46928db
SHA512

cdf1d5e4d7270a7a582edaf16dfda3253d31df48b3af6e333c716b1459fce3b62c14f8b002e77daa07c5a075b05efd3ba3b7073c45b830d0a86d20f7d22f1f52
SSDEEP

6144:1RMh9f2cQ02j1bNHu/v/4jk0+zlOMKSHLO7GcrxXkbFmjKUUFoQ/8qY93lsrbB20:vwts08bNHd8lOMKSHLBSxXupY3sPB20

Score

1^/10

Malware Config

Signatures

Modifies registry class 60 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\TypeLib\ = "{00028C01-0000-0000-0000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C0D-0000-0000-0000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C04-0000-0000-0000-000000000046}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C0E-0000-0000-0000-000000000046}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Required Categories\{426CD130-00FC-11D0-9454-00A0C91110ED}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\InprocServer32\ = "C:\\USERS\\ADMIN\\APPDATA\\LOCAL\\TEMP\\DBGRID32.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C03-0000-0000-0000-000000000046}\ = "DBGrid Property Page 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C0D-0000-0000-0000-000000000046}\ = "DBGrid Property Page 2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C04-0000-0000-0000-000000000046}\InprocServer32\ = "C:\\USERS\\ADMIN\\APPDATA\\LOCAL\\TEMP\\DBGRID32.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C08-0000-0000-0000-000000000046}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C08-0000-0000-0000-000000000046}\InprocServer32\ = "C:\\USERS\\ADMIN\\APPDATA\\LOCAL\\TEMP\\DBGRID32.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0\ = "Microsoft Data Bound Grid Control 5.0 (SP3)"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C0D-0000-0000-0000-000000000046}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0\HELPDIR\ = "C:\\USERS\\ADMIN\\APPDATA\\LOCAL\\TEMP"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C0E-0000-0000-0000-000000000046}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C0E-0000-0000-0000-000000000046}\InprocServer32\ = "C:\\USERS\\ADMIN\\APPDATA\\LOCAL\\TEMP\\DBGRID32.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\ = "DBGrid Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\MiscStatus\1\ = "164241"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C03-0000-0000-0000-000000000046}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0\FLAGS\ = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBGrid.DBGrid\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C0E-0000-0000-0000-000000000046}\ = "DBGrid Property Page 4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBGrid.DBGrid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBGrid.DBGrid\CLSID\ = "{00028C00-0000-0000-0000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C08-0000-0000-0000-000000000046}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C08-0000-0000-0000-000000000046}\ = "DBGrid Property Page 5"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBGrid.DBGrid\ = "DBGrid Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\ProgID\ = "MSDBGrid.DBGrid"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C04-0000-0000-0000-000000000046}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C03-0000-0000-0000-000000000046}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C04-0000-0000-0000-000000000046}\ = "DBGrid Property Page 3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Required Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0\0\win32\ = "C:\\USERS\\ADMIN\\APPDATA\\LOCAL\\TEMP\\DBGRID32.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C03-0000-0000-0000-000000000046}\InprocServer32\ = "C:\\USERS\\ADMIN\\APPDATA\\LOCAL\\TEMP\\DBGRID32.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\ToolboxBitmap32\ = "C:\\USERS\\ADMIN\\APPDATA\\LOCAL\\TEMP\\DBGRID32.DLL, 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C0D-0000-0000-0000-000000000046}\InprocServer32\ = "C:\\USERS\\ADMIN\\APPDATA\\LOCAL\\TEMP\\DBGRID32.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00028C01-0000-0000-0000-000000000046}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Version	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1676 wrote to memory of 3268	1676	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 3268	1676	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 3268	1676	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\DBGRID32.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\DBGRID32.dll
  2⤵
  - Modifies registry class
  PID:3268

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads