121b577a7dac22764c8d5e89c1b0504edf7803fdf6c5ed15c0c432d9605b4f7a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GFLLibraryBuilder.dll
Size

94KB
MD5

94c436a39c7a0a5b5a2a67dc33d8b6b2
SHA1

691afd5f8d88ad6ac6de6f38be9d8389e8c7d28d
SHA256

4f552fe9d1752a3e83fefacd51432e87d7f03082bd49105634e02372ae5a775d
SHA512

fd0f169520dcdf0d924b68bc1694f860f24676f00d2942000898321e08b4dfdb5d6b18dec4cd15a92799d7c8da9fa697b86a1be2b43a8562e58930add50b6d88
SSDEEP

1536:Va2bA5dMuyhOfgr/BLkv5onLKR9CinKy+Twtogh4tDIF:Va2s5dQSgrITfCiKy+TwSSF

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C9E61BE-E58F-4AE1-A304-6FF1D183804C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5198A470-F9EE-49EB-948C-F8176610A8B2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5198A470-F9EE-49EB-948C-F8176610A8B2}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0F89545-DAD8-4441-9DF4-BCB106B12234}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0F89545-DAD8-4441-9DF4-BCB106B12234}\ = "ISXMLNode"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6D4598A7-26A1-4990-BA60-DE0E212AF93C}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GFLLibraryBuilder.Builder\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A0F89545-DAD8-4441-9DF4-BCB106B12234}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E03E1BF-CCC0-4616-9C0D-8204A83BAEB4}\ = "ISXMLAttributes"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GFLLibraryBuilder.Builder\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10BF271C-85A3-4AD4-8930-CC0E3CEEADA4}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D4598A7-26A1-4990-BA60-DE0E212AF93C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D4598A7-26A1-4990-BA60-DE0E212AF93C}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{10BF271C-85A3-4AD4-8930-CC0E3CEEADA4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6D4598A7-26A1-4990-BA60-DE0E212AF93C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C9E61BE-E58F-4AE1-A304-6FF1D183804C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B8046FF-0D3A-4D85-9424-7DFCCD1BCA45}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{32496CEA-3B51-4F2F-9CE7-73D6AC942C34}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A0F89545-DAD8-4441-9DF4-BCB106B12234}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A0F89545-DAD8-4441-9DF4-BCB106B12234}\TypeLib\ = "{7B8046FF-0D3A-4D85-9424-7DFCCD1BCA45}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C9E61BE-E58F-4AE1-A304-6FF1D183804C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10BF271C-85A3-4AD4-8930-CC0E3CEEADA4}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5198A470-F9EE-49EB-948C-F8176610A8B2}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{10BF271C-85A3-4AD4-8930-CC0E3CEEADA4}\ = "ISXMLElements"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GFLLibraryBuilder.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F74AD137-A43F-46FD-A1FE-6532C3FC3E88}\ = "GFLLibraryBuilder"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GFLLibraryBuilder.Builder	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{32496CEA-3B51-4F2F-9CE7-73D6AC942C34}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A0F89545-DAD8-4441-9DF4-BCB106B12234}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E03E1BF-CCC0-4616-9C0D-8204A83BAEB4}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F74AD137-A43F-46FD-A1FE-6532C3FC3E88}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GFLLibraryBuilder.Builder.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{32496CEA-3B51-4F2F-9CE7-73D6AC942C34}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{32496CEA-3B51-4F2F-9CE7-73D6AC942C34}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A0F89545-DAD8-4441-9DF4-BCB106B12234}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GFLLibraryBuilder.Builder.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5198A470-F9EE-49EB-948C-F8176610A8B2}\ = "ISXMLElement"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0F89545-DAD8-4441-9DF4-BCB106B12234}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6D4598A7-26A1-4990-BA60-DE0E212AF93C}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B8046FF-0D3A-4D85-9424-7DFCCD1BCA45}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C9E61BE-E58F-4AE1-A304-6FF1D183804C}\TypeLib\ = "{7B8046FF-0D3A-4D85-9424-7DFCCD1BCA45}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B8046FF-0D3A-4D85-9424-7DFCCD1BCA45}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5198A470-F9EE-49EB-948C-F8176610A8B2}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5198A470-F9EE-49EB-948C-F8176610A8B2}\TypeLib\ = "{7B8046FF-0D3A-4D85-9424-7DFCCD1BCA45}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10BF271C-85A3-4AD4-8930-CC0E3CEEADA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C9E61BE-E58F-4AE1-A304-6FF1D183804C}\ = "GFL Library Builder"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{10BF271C-85A3-4AD4-8930-CC0E3CEEADA4}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GFLLibraryBuilder.DLL\AppID = "{F74AD137-A43F-46FD-A1FE-6532C3FC3E88}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E03E1BF-CCC0-4616-9C0D-8204A83BAEB4}\ = "ISXMLAttributes"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D4598A7-26A1-4990-BA60-DE0E212AF93C}\ = "ISXMLAttribute"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5198A470-F9EE-49EB-948C-F8176610A8B2}\ = "ISXMLElement"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B8046FF-0D3A-4D85-9424-7DFCCD1BCA45}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GFLLibraryBuilder.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{32496CEA-3B51-4F2F-9CE7-73D6AC942C34}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{32496CEA-3B51-4F2F-9CE7-73D6AC942C34}\TypeLib\ = "{7B8046FF-0D3A-4D85-9424-7DFCCD1BCA45}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{32496CEA-3B51-4F2F-9CE7-73D6AC942C34}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6D4598A7-26A1-4990-BA60-DE0E212AF93C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B8046FF-0D3A-4D85-9424-7DFCCD1BCA45}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B8046FF-0D3A-4D85-9424-7DFCCD1BCA45}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C9E61BE-E58F-4AE1-A304-6FF1D183804C}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{32496CEA-3B51-4F2F-9CE7-73D6AC942C34}\ = "ILibraryBuilderPlugin"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5198A470-F9EE-49EB-948C-F8176610A8B2}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E03E1BF-CCC0-4616-9C0D-8204A83BAEB4}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7B8046FF-0D3A-4D85-9424-7DFCCD1BCA45}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C9E61BE-E58F-4AE1-A304-6FF1D183804C}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2400 wrote to memory of 2860	2400	regsvr32.exe	regsvr32.exe
PID 2400 wrote to memory of 2860	2400	regsvr32.exe	regsvr32.exe
PID 2400 wrote to memory of 2860	2400	regsvr32.exe	regsvr32.exe
PID 2400 wrote to memory of 2860	2400	regsvr32.exe	regsvr32.exe
PID 2400 wrote to memory of 2860	2400	regsvr32.exe	regsvr32.exe
PID 2400 wrote to memory of 2860	2400	regsvr32.exe	regsvr32.exe
PID 2400 wrote to memory of 2860	2400	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\GFLLibraryBuilder.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2400

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\GFLLibraryBuilder.dll
2⤵
- Modifies registry class
PID:2860

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads