c8bf1c67c45aaee0278659b638c1a6ad14717e88b58da0e94f36e477e7a47678

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03-05-2024 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8bf1c67c45aaee0278659b638c1a6ad14717e88b58da0e94f36e477e7a47678.dll
Size

509KB
MD5

f939d4ac1f58e258b0e0856ff81017b6
SHA1

4d007728cecf7a2ab737aa1d525d68cebf6cf480
SHA256

c8bf1c67c45aaee0278659b638c1a6ad14717e88b58da0e94f36e477e7a47678
SHA512

b4077f91ca26938203706d1704d3e8f49e49238429262f5b2056e138b9c9b13cb3b6060ebeb332b889b74791f37ff768c13a4964631808c75234e14134fb0ab8
SSDEEP

6144:ra8zeF0rXCeJuDx3OJda+ONYnHyRKXAbZR/fjtxsYVUz8Z8tLa8zeF4j:FzzrXCPx1pY0bZZfjxvKz

Score

1^/10

Malware Config

Signatures

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}\ProgID\ = "c8bf1c67c45aaee0278659b638c1a6ad14717e88b58da0e94f36e477e7a47678.ShellExecuteHook"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}\ = "Maihook7003"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\c8bf1c67c45aaee0278659b638c1a6ad14717e88b58da0e94f36e477e7a47678.ShellExecuteHook\ = "Maihook7003"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\c8bf1c67c45aaee0278659b638c1a6ad14717e88b58da0e94f36e477e7a47678.ShellExecuteHook\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c8bf1c67c45aaee0278659b638c1a6ad14717e88b58da0e94f36e477e7a47678.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\c8bf1c67c45aaee0278659b638c1a6ad14717e88b58da0e94f36e477e7a47678.ShellExecuteHook	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\c8bf1c67c45aaee0278659b638c1a6ad14717e88b58da0e94f36e477e7a47678.ShellExecuteHook\Clsid\ = "{6E224DF2-19D5-11D8-9BD3-5254AB1FD902}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2848	2268	regsvr32.exe	28
PID 2268 wrote to memory of 2848	2268	regsvr32.exe	28
PID 2268 wrote to memory of 2848	2268	regsvr32.exe	28
PID 2268 wrote to memory of 2848	2268	regsvr32.exe	28
PID 2268 wrote to memory of 2848	2268	regsvr32.exe	28
PID 2268 wrote to memory of 2848	2268	regsvr32.exe	28
PID 2268 wrote to memory of 2848	2268	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c8bf1c67c45aaee0278659b638c1a6ad14717e88b58da0e94f36e477e7a47678.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c8bf1c67c45aaee0278659b638c1a6ad14717e88b58da0e94f36e477e7a47678.dll
  2⤵
  - Modifies registry class
  PID:2848

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads