469157c1bf03f6c7336b9272708f7b29d6a72f0d2886bb415dbd71ebf19f0f89

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

469157c1bf03f6c7336b9272708f7b29d6a72f0d2886bb415dbd71ebf19f0f89.dll
Size

232KB
MD5

311f9e65882d95faabbf862ecc4401c2
SHA1

86b4d91a1da136b668046ce73df42b11ac14dd33
SHA256

469157c1bf03f6c7336b9272708f7b29d6a72f0d2886bb415dbd71ebf19f0f89
SHA512

3ddc1c1a629add92e256d3fe93e83752791c05c4a316ede9aee9ebee0918319da71a688e6fd34dc47dda414e551e0c742d63a588f2fa4d5dd5ce1aa58cbb2fc8
SSDEEP

1536:usjbSAu/rdDtaQmkf/+hY6FpzcBFsEEuKop21MbcPKzv//P7GkrPb3oVNDjV:us6AQxIQd/+hJp6aQPb3oVNHV

Score

1^/10

Malware Config

Signatures

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BF9B5572-295A-44CD-93F2-4AE6EA17083C}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BF9B5572-295A-44CD-93F2-4AE6EA17083C}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\469157c1bf03f6c7336b9272708f7b29d6a72f0d2886bb415dbd71ebf19f0f89.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BF9B5572-295A-44CD-93F2-4AE6EA17083C}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{901E2EC1-9169-4AB1-97A9-88876EFF80FD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{901E2EC1-9169-4AB1-97A9-88876EFF80FD}\ = "IICNBData5678"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{901E2EC1-9169-4AB1-97A9-88876EFF80FD}\TypeLib\ = "{BF9B5572-295A-44CD-93F2-4AE6EA17083C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{901E2EC1-9169-4AB1-97A9-88876EFF80FD}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BF9B5572-295A-44CD-93F2-4AE6EA17083C}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{901E2EC1-9169-4AB1-97A9-88876EFF80FD}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BF9B5572-295A-44CD-93F2-4AE6EA17083C}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BF9B5572-295A-44CD-93F2-4AE6EA17083C}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{901E2EC1-9169-4AB1-97A9-88876EFF80FD}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{901E2EC1-9169-4AB1-97A9-88876EFF80FD}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{901E2EC1-9169-4AB1-97A9-88876EFF80FD}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{901E2EC1-9169-4AB1-97A9-88876EFF80FD}\ = "IICNBData5678"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BF9B5572-295A-44CD-93F2-4AE6EA17083C}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{901E2EC1-9169-4AB1-97A9-88876EFF80FD}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{901E2EC1-9169-4AB1-97A9-88876EFF80FD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BF9B5572-295A-44CD-93F2-4AE6EA17083C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BF9B5572-295A-44CD-93F2-4AE6EA17083C}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{901E2EC1-9169-4AB1-97A9-88876EFF80FD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{901E2EC1-9169-4AB1-97A9-88876EFF80FD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{901E2EC1-9169-4AB1-97A9-88876EFF80FD}\TypeLib\ = "{BF9B5572-295A-44CD-93F2-4AE6EA17083C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BF9B5572-295A-44CD-93F2-4AE6EA17083C}\1.0\ = "DataServerPS_C 1.0 Type Library"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 3040	3296	regsvr32.exe	91
PID 3296 wrote to memory of 3040	3296	regsvr32.exe	91
PID 3296 wrote to memory of 3040	3296	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\469157c1bf03f6c7336b9272708f7b29d6a72f0d2886bb415dbd71ebf19f0f89.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\469157c1bf03f6c7336b9272708f7b29d6a72f0d2886bb415dbd71ebf19f0f89.dll
  2⤵
  - Modifies registry class
  PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5992

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads