9c93cd60a6108167da782ab136db0779f684b4a6cfbf6e9ac570a66c31431ac2 | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 20:08

Sharing

Report Analysis Logs

General

Target

ContextBG.dll
Size

397KB
MD5

bd21095fe72f07e36d76c817496f113a
SHA1

438e389fb0ad76cc7df869c16d8c27f38d705ee1
SHA256

a0cecf910cc4a95fa608b1b68a3c65254edb8ade9cfe5fe8a3eb729581dddbca
SHA512

97ce444d4a35d794e9b774392c9c5f16b71e3c967113853d13672ec30b3e8dae7f8a13834e6821f2456cf3e27d10e7d27790f4d8fb24d293442ceaf7e690ebd9
SSDEEP

6144:gPZKVnhWWLHNSh1SteQ3zddxAwCA6I2XesqcXbBwytwR5GcpjS8L:awjxmMbAwCOAqEHtwPGcE8L

Score

1^/10

Malware Config

Signatures

Modifies registry class 9 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C125022-639D-43cc-9F3D-647E6CC69EF1}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C125022-639D-43cc-9F3D-647E6CC69EF1}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFileSystemObjects\shellex\ContextMenuHandlers\ContextBG	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\ContextBG	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C125022-639D-43cc-9F3D-647E6CC69EF1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C125022-639D-43cc-9F3D-647E6CC69EF1}\ = "ContextBG"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C125022-639D-43cc-9F3D-647E6CC69EF1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ContextBG.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ContextBG\ = "{6C125022-639D-43cc-9F3D-647E6CC69EF1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\ContextBG\ = "{6C125022-639D-43cc-9F3D-647E6CC69EF1}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3048 wrote to memory of 2496	3048	regsvr32.exe	regsvr32.exe
PID 3048 wrote to memory of 2496	3048	regsvr32.exe	regsvr32.exe
PID 3048 wrote to memory of 2496	3048	regsvr32.exe	regsvr32.exe
PID 3048 wrote to memory of 2496	3048	regsvr32.exe	regsvr32.exe
PID 3048 wrote to memory of 2496	3048	regsvr32.exe	regsvr32.exe
PID 3048 wrote to memory of 2496	3048	regsvr32.exe	regsvr32.exe
PID 3048 wrote to memory of 2496	3048	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ContextBG.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ContextBG.dll
  2⤵
  - Modifies registry class
  PID:2496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads