4f5c33b54a841bae7acb0e8216de5120a5b068ac60cfd158eca260d1f83cf067

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 08:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVR/webview.dll
Size

736KB
MD5

6d50265fe4d14e0ddae1b73aed37e864
SHA1

2505ef562b6861bc1189967c88e0453797a88df8
SHA256

68da49bcd3c1105405297b5420ae86529aec7067d6cd8427d30be577cb6b9ced
SHA512

61a6e63c20b10a8b9877f3d3590e06cf0f3f1d25ddd708fc5c4f135c899f212216612ef80b95c8d600d224ab080f50032a34db1281e34d2221f580db9d4949c9
SSDEEP

6144:UwQOAxBfnUDiNk5jtgf9NVmXNcc4g9xHE4i/eXXeuQeewQee7QeesQeezPQeefQJ:TiNst49N+cczk//eOhE2522xjXW

Score

1^/10

Malware Config

Signatures

Modifies registry class 56 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1408_cn_V8.3.0.0\\1408_cn_8.3.0.0\\DVR\\webview.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\ProgID\ = "ATLFire.WebView2.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1408_cn_V8.3.0.0\\1408_cn_8.3.0.0\\DVR\\webview.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2.1\ = "WebView2 Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2\CLSID\ = "{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\ = "WebView2 Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\Insertable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\TypeLib\ = "{D0B34E76-260E-4355-B391-6963F242D13D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\TypeLib\ = "{D0B34E76-260E-4355-B391-6963F242D13D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\ = "IWebView2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2\CurVer\ = "ATLFire.WebView2.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\MiscStatus\1\ = "131473"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\VersionIndependentProgID\ = "ATLFire.WebView2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1408_cn_V8.3.0.0\\1408_cn_8.3.0.0\\DVR"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\TypeLib\ = "{D0B34E76-260E-4355-B391-6963F242D13D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\ = "IWebView2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2.1\CLSID\ = "{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2\ = "WebView2 Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1408_cn_V8.3.0.0\\1408_cn_8.3.0.0\\DVR\\webview.dll, 101"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC850FC9-85F6-4A47-938A-25BC8EF6A154}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ATLFire.WebView2.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CF6E9E0-4FC0-48F6-A744-800A09D79D6B}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}\1.0\ = "ATLFire 3.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D0B34E76-260E-4355-B391-6963F242D13D}\1.0\HELPDIR	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1796 wrote to memory of 2628	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 2628	1796	regsvr32.exe	regsvr32.exe
PID 1796 wrote to memory of 2628	1796	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1408_cn_V8.3.0.0\1408_cn_8.3.0.0\DVR\webview.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1408_cn_V8.3.0.0\1408_cn_8.3.0.0\DVR\webview.dll
2⤵
- Modifies registry class
PID:2628

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads