777730664beeade5b6f7b22e8dab7682caa8dfa1456b4c503be930f857265cea

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GoogleTranslator.dll
Size

104KB
MD5

b65c33a946268df95bb3e3c4a23fc355
SHA1

4242015823ad88f9a4c1f5418f209988030cd5af
SHA256

1eda6b53b2baa94ed7e6b234b7e1293de965264998155cec64db9c2c994e2463
SHA512

a784b68ad612ea5d145658df4b23ec8789b99199cda738cd74e769dbded8233a0729e7781829f20774ce8abb5890bc47c7a9253560554af46adb84c125c380a5
SSDEEP

1536:ZjS0Caz5oZKs8+R+qKS8WqlZ6isBw9agS5Hl5rWeycltHfw0+4+A+L+8Ehrtop5W:ZjS0lz5oZFiEisnNX4vre/kvqcKDp

Score

1^/10

Malware Config

Signatures

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8E8F6DE-10D5-4D70-987B-CFCF4A6F7072}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8E8F6DE-10D5-4D70-987B-CFCF4A6F7072}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{2F6C676A-80AA-4D0E-A1E4-F28550F1B6A5}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{2F6C676A-80AA-4D0E-A1E4-F28550F1B6A5}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8748C80-628C-4B67-AFCB-9376492D75DD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8748C80-628C-4B67-AFCB-9376492D75DD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8748C80-628C-4B67-AFCB-9376492D75DD}\TypeLib\ = "{2F6C676A-80AA-4D0E-A1E4-F28550F1B6A5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8E8F6DE-10D5-4D70-987B-CFCF4A6F7072}\ProgID\ = "GoogleTranslator.IEExtension"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8E8F6DE-10D5-4D70-987B-CFCF4A6F7072}\VERSION	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C8748C80-628C-4B67-AFCB-9376492D75DD}\TypeLib\ = "{2F6C676A-80AA-4D0E-A1E4-F28550F1B6A5}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8748C80-628C-4B67-AFCB-9376492D75DD}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{2F6C676A-80AA-4D0E-A1E4-F28550F1B6A5}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{2F6C676A-80AA-4D0E-A1E4-F28550F1B6A5}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{2F6C676A-80AA-4D0E-A1E4-F28550F1B6A5}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{2F6C676A-80AA-4D0E-A1E4-F28550F1B6A5}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C8748C80-628C-4B67-AFCB-9376492D75DD}\ = "_IEExtension"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C8748C80-628C-4B67-AFCB-9376492D75DD}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C8748C80-628C-4B67-AFCB-9376492D75DD}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8748C80-628C-4B67-AFCB-9376492D75DD}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8E8F6DE-10D5-4D70-987B-CFCF4A6F7072}\ = "GoogleTranslator.IEExtension"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8E8F6DE-10D5-4D70-987B-CFCF4A6F7072}\VERSION\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleTranslator.IEExtension\Clsid\ = "{B8E8F6DE-10D5-4D70-987B-CFCF4A6F7072}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8E8F6DE-10D5-4D70-987B-CFCF4A6F7072}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C8748C80-628C-4B67-AFCB-9376492D75DD}\ = "IEExtension"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8E8F6DE-10D5-4D70-987B-CFCF4A6F7072}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{2F6C676A-80AA-4D0E-A1E4-F28550F1B6A5}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{2F6C676A-80AA-4D0E-A1E4-F28550F1B6A5}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C8748C80-628C-4B67-AFCB-9376492D75DD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8E8F6DE-10D5-4D70-987B-CFCF4A6F7072}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8E8F6DE-10D5-4D70-987B-CFCF4A6F7072}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8E8F6DE-10D5-4D70-987B-CFCF4A6F7072}\TypeLib\ = "{2F6C676A-80AA-4D0E-A1E4-F28550F1B6A5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{2F6C676A-80AA-4D0E-A1E4-F28550F1B6A5}\1.0\ = "ShaPlus Google Translator"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C8748C80-628C-4B67-AFCB-9376492D75DD}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8E8F6DE-10D5-4D70-987B-CFCF4A6F7072}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8E8F6DE-10D5-4D70-987B-CFCF4A6F7072}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GoogleTranslator.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8E8F6DE-10D5-4D70-987B-CFCF4A6F7072}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{2F6C676A-80AA-4D0E-A1E4-F28550F1B6A5}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GoogleTranslator.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C8748C80-628C-4B67-AFCB-9376492D75DD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8748C80-628C-4B67-AFCB-9376492D75DD}\ = "_IEExtension"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C8748C80-628C-4B67-AFCB-9376492D75DD}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8748C80-628C-4B67-AFCB-9376492D75DD}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleTranslator.IEExtension	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleTranslator.IEExtension\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C8748C80-628C-4B67-AFCB-9376492D75DD}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleTranslator.IEExtension\ = "GoogleTranslator.IEExtension"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1372	1624	regsvr32.exe	28
PID 1624 wrote to memory of 1372	1624	regsvr32.exe	28
PID 1624 wrote to memory of 1372	1624	regsvr32.exe	28
PID 1624 wrote to memory of 1372	1624	regsvr32.exe	28
PID 1624 wrote to memory of 1372	1624	regsvr32.exe	28
PID 1624 wrote to memory of 1372	1624	regsvr32.exe	28
PID 1624 wrote to memory of 1372	1624	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\GoogleTranslator.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\GoogleTranslator.dll
  2⤵
  - Modifies registry class
  PID:1372

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads