c4079adbd900f429976e7363d635dca803e7d244675263ebb30b1ea8fc889e29

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CaLibraryPro.dll
Size

1007KB
MD5

628096820b6af8b72810ee27634db5c5
SHA1

9f297e1095d1e42e3c68d99e6faffa36ace16d85
SHA256

4bd35a051caaa3fcf240b18111415f062329ff70af844fd5ea21ef2a81662d97
SHA512

6d5c3fc3a3475fc90a7941dc515254f1da03f041d6300790ac9c39530b7dada7990f79ddbb35dba88a62d8c9c4bea8fd381b75a862874a8ff381e2bd6392cc6c
SSDEEP

24576:+7DpBQzFjXMGGY1YEyjxB0KpHeQuRRBzpqB9GBKG36w:iBM79YEEPHe/RRBzpqWKG3P

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CALibraryPro.CertificateInfo.1\ = "CertificateInfo Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\AppID = "{7C3E0587-4C95-4D48-804C-6D9F2410C759}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\MiscStatus\1\ = "131473"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33D58D22-F0F4-475F-A7F3-59C8016BB56A}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D60ACE81-78F1-42D8-A8B1-3E3BD3761AFB}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D60ACE81-78F1-42D8-A8B1-3E3BD3761AFB}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{01945DE4-FA63-4DCA-8182-B3DE09D2D440}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33D58D22-F0F4-475F-A7F3-59C8016BB56A}\ = "ICertificateInfo"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{01945DE4-FA63-4DCA-8182-B3DE09D2D440}\TypeLib\ = "{D60ACE81-78F1-42D8-A8B1-3E3BD3761AFB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33D58D22-F0F4-475F-A7F3-59C8016BB56A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\TypeLib\ = "{D60ACE81-78F1-42D8-A8B1-3E3BD3761AFB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CALibraryPro.CertificateInfo\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33D58D22-F0F4-475F-A7F3-59C8016BB56A}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33D58D22-F0F4-475F-A7F3-59C8016BB56A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33D58D22-F0F4-475F-A7F3-59C8016BB56A}\TypeLib\ = "{D60ACE81-78F1-42D8-A8B1-3E3BD3761AFB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\VersionIndependentProgID\ = "CALibraryPro.CertificateInfo"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CaLibraryPro.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{01945DE4-FA63-4DCA-8182-B3DE09D2D440}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33D58D22-F0F4-475F-A7F3-59C8016BB56A}\TypeLib\ = "{D60ACE81-78F1-42D8-A8B1-3E3BD3761AFB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33D58D22-F0F4-475F-A7F3-59C8016BB56A}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{01945DE4-FA63-4DCA-8182-B3DE09D2D440}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D60ACE81-78F1-42D8-A8B1-3E3BD3761AFB}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{01945DE4-FA63-4DCA-8182-B3DE09D2D440}\ = "_ICertificateInfoEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{01945DE4-FA63-4DCA-8182-B3DE09D2D440}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33D58D22-F0F4-475F-A7F3-59C8016BB56A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33D58D22-F0F4-475F-A7F3-59C8016BB56A}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\ProgID\ = "CALibraryPro.CertificateInfo.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D60ACE81-78F1-42D8-A8B1-3E3BD3761AFB}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D60ACE81-78F1-42D8-A8B1-3E3BD3761AFB}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{01945DE4-FA63-4DCA-8182-B3DE09D2D440}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CALibraryPro.CertificateInfo.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CALibraryPro.CertificateInfo\CLSID\ = "{6EF8218C-BA23-421E-8BDA-B101FC829C53}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{01945DE4-FA63-4DCA-8182-B3DE09D2D440}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{01945DE4-FA63-4DCA-8182-B3DE09D2D440}\TypeLib\ = "{D60ACE81-78F1-42D8-A8B1-3E3BD3761AFB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CALibraryPro.CertificateInfo.1\CLSID\ = "{6EF8218C-BA23-421E-8BDA-B101FC829C53}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CALibraryPro.CertificateInfo\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{01945DE4-FA63-4DCA-8182-B3DE09D2D440}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{01945DE4-FA63-4DCA-8182-B3DE09D2D440}\ = "_ICertificateInfoEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D60ACE81-78F1-42D8-A8B1-3E3BD3761AFB}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CaLibraryPro.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33D58D22-F0F4-475F-A7F3-59C8016BB56A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33D58D22-F0F4-475F-A7F3-59C8016BB56A}\ = "ICertificateInfo"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CALibraryPro.CertificateInfo.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CALibraryPro.CertificateInfo\ = "CertificateInfo Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CaLibraryPro.dll, 106"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D60ACE81-78F1-42D8-A8B1-3E3BD3761AFB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D60ACE81-78F1-42D8-A8B1-3E3BD3761AFB}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D60ACE81-78F1-42D8-A8B1-3E3BD3761AFB}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{33D58D22-F0F4-475F-A7F3-59C8016BB56A}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33D58D22-F0F4-475F-A7F3-59C8016BB56A}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CALibraryPro.CertificateInfo	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EF8218C-BA23-421E-8BDA-B101FC829C53}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{01945DE4-FA63-4DCA-8182-B3DE09D2D440}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1848	2368	regsvr32.exe	28
PID 2368 wrote to memory of 1848	2368	regsvr32.exe	28
PID 2368 wrote to memory of 1848	2368	regsvr32.exe	28
PID 2368 wrote to memory of 1848	2368	regsvr32.exe	28
PID 2368 wrote to memory of 1848	2368	regsvr32.exe	28
PID 2368 wrote to memory of 1848	2368	regsvr32.exe	28
PID 2368 wrote to memory of 1848	2368	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\CaLibraryPro.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\CaLibraryPro.dll
  2⤵
  - Modifies registry class
  PID:1848

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads