121b577a7dac22764c8d5e89c1b0504edf7803fdf6c5ed15c0c432d9605b4f7a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DocumentReader.dll
Size

133KB
MD5

57a119e53a13833a2b17a66c283d60a4
SHA1

6de7d3a844e8157b71e9fef01e9ce00140c73c14
SHA256

d1b76d39ee0358407025a4214a8e8b58ba85dcc807f29294fb56991b02c7d50f
SHA512

bd93faedc07475881c737f1ad2e23f70fc4681151b1acfa1532c0b3eeb9f76717f92da27c8a86485fea06dd0e4dd63224dcd2318852d3ad6fba272251f263b84
SSDEEP

3072:ASGlTEZNIr1KqsnVA5OctzRD+T0XO+mu:ASQhV5xrtX

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{32496CEA-3B51-4F2F-9CE7-73D6AC942C34}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E03E1BF-CCC0-4616-9C0D-8204A83BAEB4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9F51B1E-DB0F-4EEE-9B36-46151994C715}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A0F89545-DAD8-4441-9DF4-BCB106B12234}\TypeLib\ = "{607C3F69-850D-4413-A81A-CF1C849BF387}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E03E1BF-CCC0-4616-9C0D-8204A83BAEB4}\TypeLib\ = "{607C3F69-850D-4413-A81A-CF1C849BF387}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{32496CEA-3B51-4F2F-9CE7-73D6AC942C34}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5198A470-F9EE-49EB-948C-F8176610A8B2}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0F89545-DAD8-4441-9DF4-BCB106B12234}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{10BF271C-85A3-4AD4-8930-CC0E3CEEADA4}\TypeLib\ = "{607C3F69-850D-4413-A81A-CF1C849BF387}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6D4598A7-26A1-4990-BA60-DE0E212AF93C}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CruxP2P.DocReader.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CruxP2P.DocReader\CLSID\ = "{E9F51B1E-DB0F-4EEE-9B36-46151994C715}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5198A470-F9EE-49EB-948C-F8176610A8B2}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E03E1BF-CCC0-4616-9C0D-8204A83BAEB4}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D4598A7-26A1-4990-BA60-DE0E212AF93C}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DocumentReader.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9F51B1E-DB0F-4EEE-9B36-46151994C715}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{32496CEA-3B51-4F2F-9CE7-73D6AC942C34}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5198A470-F9EE-49EB-948C-F8176610A8B2}\TypeLib\ = "{607C3F69-850D-4413-A81A-CF1C849BF387}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5198A470-F9EE-49EB-948C-F8176610A8B2}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A0F89545-DAD8-4441-9DF4-BCB106B12234}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0F89545-DAD8-4441-9DF4-BCB106B12234}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{10BF271C-85A3-4AD4-8930-CC0E3CEEADA4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CruxP2P.DocReader	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB0A7BF2-94C0-4DAA-8256-2BB6C3648050}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D4598A7-26A1-4990-BA60-DE0E212AF93C}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{607C3F69-850D-4413-A81A-CF1C849BF387}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6D4598A7-26A1-4990-BA60-DE0E212AF93C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9F51B1E-DB0F-4EEE-9B36-46151994C715}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DocumentReader.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{607C3F69-850D-4413-A81A-CF1C849BF387}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A0F89545-DAD8-4441-9DF4-BCB106B12234}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{10BF271C-85A3-4AD4-8930-CC0E3CEEADA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10BF271C-85A3-4AD4-8930-CC0E3CEEADA4}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E03E1BF-CCC0-4616-9C0D-8204A83BAEB4}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CruxP2P.DocReader\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9F51B1E-DB0F-4EEE-9B36-46151994C715}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9F51B1E-DB0F-4EEE-9B36-46151994C715}\TypeLib\ = "{607C3F69-850D-4413-A81A-CF1C849BF387}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CruxP2P.DocReader.1\ = "Document Metadata Reader and Thumbnailer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E03E1BF-CCC0-4616-9C0D-8204A83BAEB4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BEC42E3F-4B6B-49A3-A099-EB3D6752AA02}\ = "DocumentReader"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{607C3F69-850D-4413-A81A-CF1C849BF387}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{32496CEA-3B51-4F2F-9CE7-73D6AC942C34}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{32496CEA-3B51-4F2F-9CE7-73D6AC942C34}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5198A470-F9EE-49EB-948C-F8176610A8B2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E03E1BF-CCC0-4616-9C0D-8204A83BAEB4}\TypeLib\ = "{607C3F69-850D-4413-A81A-CF1C849BF387}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6D4598A7-26A1-4990-BA60-DE0E212AF93C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9F51B1E-DB0F-4EEE-9B36-46151994C715}\ = "Document Metadata Reader and Thumbnailer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{607C3F69-850D-4413-A81A-CF1C849BF387}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5198A470-F9EE-49EB-948C-F8176610A8B2}\ = "ISXMLElement"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{10BF271C-85A3-4AD4-8930-CC0E3CEEADA4}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{10BF271C-85A3-4AD4-8930-CC0E3CEEADA4}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10BF271C-85A3-4AD4-8930-CC0E3CEEADA4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E03E1BF-CCC0-4616-9C0D-8204A83BAEB4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB0A7BF2-94C0-4DAA-8256-2BB6C3648050}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{607C3F69-850D-4413-A81A-CF1C849BF387}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0F89545-DAD8-4441-9DF4-BCB106B12234}\TypeLib\ = "{607C3F69-850D-4413-A81A-CF1C849BF387}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9F51B1E-DB0F-4EEE-9B36-46151994C715}\ProgID\ = "CruxP2P.DocReader.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5198A470-F9EE-49EB-948C-F8176610A8B2}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E03E1BF-CCC0-4616-9C0D-8204A83BAEB4}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB0A7BF2-94C0-4DAA-8256-2BB6C3648050}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB0A7BF2-94C0-4DAA-8256-2BB6C3648050}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{32496CEA-3B51-4F2F-9CE7-73D6AC942C34}\TypeLib\ = "{607C3F69-850D-4413-A81A-CF1C849BF387}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10BF271C-85A3-4AD4-8930-CC0E3CEEADA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{32496CEA-3B51-4F2F-9CE7-73D6AC942C34}\TypeLib	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2176 wrote to memory of 1920	2176	regsvr32.exe	regsvr32.exe
PID 2176 wrote to memory of 1920	2176	regsvr32.exe	regsvr32.exe
PID 2176 wrote to memory of 1920	2176	regsvr32.exe	regsvr32.exe
PID 2176 wrote to memory of 1920	2176	regsvr32.exe	regsvr32.exe
PID 2176 wrote to memory of 1920	2176	regsvr32.exe	regsvr32.exe
PID 2176 wrote to memory of 1920	2176	regsvr32.exe	regsvr32.exe
PID 2176 wrote to memory of 1920	2176	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\DocumentReader.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\DocumentReader.dll
2⤵
- Modifies registry class
PID:1920

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads