1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c.dll
Size

361KB
MD5

2e20e7577720dfc63bf519442c505199
SHA1

c7e544195f1583892b76089f87b648cf1816470d
SHA256

1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c
SHA512

25986b9739e61811716a86ae33ff2c69c52912a164c2a561171ac8fc2ad5baea7cf0727396673c4c960df32df2cfe3fdb6e78b70dfed2cedcceba72b47f6da56
SSDEEP

3072:1Zr97TeKgCi8RhgAWIY3Lab00WLZr97TeKgCjjn:X5TxL99+x5TxLX

Score

1^/10

Malware Config

Signatures

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78E611A2-E484-4A0D-811E-C40100A3F452}\ = "Maihook1007"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78E611A2-E484-4A0D-811E-C40100A3F452}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c.ShellExecuteHook1007\Clsid\ = "{78E611A2-E484-4A0D-811E-C40100A3F452}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78E611A2-E484-4A0D-811E-C40100A3F452}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78E611A2-E484-4A0D-811E-C40100A3F452}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78E611A2-E484-4A0D-811E-C40100A3F452}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c.ShellExecuteHook1007	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c.ShellExecuteHook1007\ = "Maihook1007"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c.ShellExecuteHook1007\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78E611A2-E484-4A0D-811E-C40100A3F452}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78E611A2-E484-4A0D-811E-C40100A3F452}\ProgID\ = "1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c.ShellExecuteHook1007"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2264	2104	regsvr32.exe	28
PID 2104 wrote to memory of 2264	2104	regsvr32.exe	28
PID 2104 wrote to memory of 2264	2104	regsvr32.exe	28
PID 2104 wrote to memory of 2264	2104	regsvr32.exe	28
PID 2104 wrote to memory of 2264	2104	regsvr32.exe	28
PID 2104 wrote to memory of 2264	2104	regsvr32.exe	28
PID 2104 wrote to memory of 2264	2104	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1e52d47027578a737fa49878deba4e00318de384cffdfc9a7c9c37fb1b23ee5c.dll
  2⤵
  - Modifies registry class
  PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2264-0-0x00000000001D0000-0x00000000001EF000-memory.dmp

Filesize
124KB

Download
memory/2264-1-0x00000000001D0000-0x00000000001EF000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads