9225bc7009a455e0506f32bff1f987198bdb5db25fecac5263122947e0a32bc8

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Windows.Networking.BackgroundTransfer.dll
Size 399KB
Sample240527-nvs5sabb24
SHA256 9225bc7009a455e0506f32bff1f987198bdb5db25fecac5263122947e0a32bc8
MD5 d180d4667a385761f1f47401cd097854
SHA1 b469e21f3dd09ad458af6117fc0e72c7e2c3da93
SHA512 bbecbfca381e5dbf1882bc2c990da9c4239cd11812748ff7655b642181ba2199c7fe3defbb0b2d3916bb8bf1e328c98439dc3867711ad3f127fb8fed73cadd8b
SSDEEP 6144:qds4qOZN3FfN6K4T/uESM5ghMYvA2cRsmYa:qd7qg5+LbyhPvA2EsmYa
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CF303199-DE3B-5DAC-A703-6C57D80821C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35DDAEFA-DB6A-5D0D-BA54-A0728401171E}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF420BFD-D9A1-50F3-958E-536947FE43DD}\ProxyStubClsid32\ = "{6EA4B9B1-0121-46C9-95CF-8E5392CB8234}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAD33B04-1192-4BF4-8B68-39C5ADD244E2}\ProxyStubClsid32\ = "{6EA4B9B1-0121-46C9-95CF-8E5392CB8234}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{52A65A35-C64E-426C-9919-540D0D21A650}\NumMethods\ = "8"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F2875CFB-9B05-4741-9121-740A83E247DF}\ = "__x_Windows_CNetworking_CBackgroundTransfer_CIBackgroundUploaderStaticMethods"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{679BA429-E295-4029-A144-D06B3E2B0C4F}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{37CE3D55-AB34-4594-B4FE-E04988FB13F6}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{84586295-BA25-4CF3-9866-2D0941E68368}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2FAA1327-1AD4-4CA5-B2CD-08DBF0746AFE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{f6fd69cb-e6e7-56d5-9be6-e0dc4683fa80}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{608a29a8-bbc5-5ea3-b3f7-87edc4e7bbbc}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2D8CE3D-AE6B-47ED-8706-34C5053B451B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A8DC2A04-3F44-5046-8182-CD0EC147E17D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2FAA1327-1AD4-4CA5-B2CD-08DBF0746AFE}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{caa85133-73d7-5f96-ab2d-fbb4fa00f715}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A9DA250-C769-458C-AFE8-FEB8D4D3B2EF}\ = "__x_Windows_CNetworking_CBackgroundTransfer_CIBackgroundTransferBase"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{43EF3A5F-CC7D-566D-A92A-4CAA76B92A1F}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A8D6F754-7DC1-4CD9-8810-2A6AA9417E11}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E86A4F5D-743A-5F18-9D4C-BC8ED5942659}\NumMethods\ = "11"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD56B4B0-474B-486B-A223-B2017073F239}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A3CCED40-8F9C-4353-9CD4-290DEE387C38}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{910BB1F3-F189-5284-B944-81F68A599396}\NumMethods\ = "7"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{84586295-BA25-4CF3-9866-2D0941E68368}\ProxyStubClsid32\ = "{6EA4B9B1-0121-46C9-95CF-8E5392CB8234}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E4C6A3C-48A4-5E22-B29A-3E429469462F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44212EA1-B524-5AEE-A320-7199225381D1}\NumMethods\ = "9"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F2875CFB-9B05-4741-9121-740A83E247DF}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD56B4B0-474B-486B-A223-B2017073F239}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{caa85133-73d7-5f96-ab2d-fbb4fa00f715}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5D14E906-9266-4808-BD71-5925F2A3130A}\ProxyStubClsid32\ = "{6EA4B9B1-0121-46C9-95CF-8E5392CB8234}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A9DA250-C769-458C-AFE8-FEB8D4D3B2EF}\ProxyStubClsid32\ = "{6EA4B9B1-0121-46C9-95CF-8E5392CB8234}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5D9E286B-D9B8-476B-8DD8-F34B40EBD528}\ = "__x_Windows_CNetworking_CBackgroundTransfer_CInternal_CIBackgroundTransferContentPartSerializer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E3FFF77C-FA2D-5AE7-93AD-3EFB469DFE08}\NumMethods\ = "10"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33D569DB-197C-5717-945D-87FDFC339302}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAD33B04-1192-4BF4-8B68-39C5ADD244E2}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30BEECF0-102C-4737-A96F-6F6B7CE7421F}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ccd13730-fed3-54e8-8471-096e4b64cadd}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{43EF3A5F-CC7D-566D-A92A-4CAA76B92A1F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44212EA1-B524-5AEE-A320-7199225381D1}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1986b372-0ddb-520c-b72d-fb2577e99ff5}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{37CE3D55-AB34-4594-B4FE-E04988FB13F6}\NumMethods	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\WOW6432Node\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E5624E0-7389-434C-8B35-427FD36BBDAE}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2D8CE3D-AE6B-47ED-8706-34C5053B451B}\NumMethods\ = "7"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A8DC2A04-3F44-5046-8182-CD0EC147E17D}\ = "__FIAsyncOperation_1_Windows__CNetworking__CBackgroundTransfer__CUnconstrainedTransferRequestResult"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{43EF3A5F-CC7D-566D-A92A-4CAA76B92A1F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAD68818-0C38-5CDE-AEC1-C6A7618711F7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E0612CE-0C34-4463-807F-198A1B8BD4AD}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AE42CDDF-3042-5D92-A01E-643C252B8050}\NumMethods\ = "9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F2875CFB-9B05-4741-9121-740A83E247DF}\ProxyStubClsid32\ = "{6EA4B9B1-0121-46C9-95CF-8E5392CB8234}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E3FFF77C-FA2D-5AE7-93AD-3EFB469DFE08}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30BEECF0-102C-4737-A96F-6F6B7CE7421F}\ = "__x_Windows_CNetworking_CBackgroundTransfer_CInternal_CITaskNotification"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{07fbc351-781d-52c7-9558-a453e5703f29}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{b2ff13f1-c743-54f4-bccc-f08e16a87890}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BC2625-40A1-47BE-9268-AEC814F14F01}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{84586295-BA25-4CF3-9866-2D0941E68368}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E86A4F5D-743A-5F18-9D4C-BC8ED5942659}\ = "__FIAsyncOperationWithProgress_2_Windows__CNetworking__CBackgroundTransfer__CDownloadOperation_Windows__CNetworking__CBackgroundTransfer__CDownloadOperation"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BC2625-40A1-47BE-9268-AEC814F14F01}\NumMethods\ = "4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1C79333-6649-4B1D-A826-A4B3DD234D0B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9BB02EF7-FD53-4D03-92E8-F08EA924A399}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5092D678-FA0C-44A3-8DCF-EC7D6A9A9410}\NumMethods\ = "14"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E0612CE-0C34-4463-807F-198A1B8BD4AD}\ProxyStubClsid32\ = "{6EA4B9B1-0121-46C9-95CF-8E5392CB8234}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{781b479c-0207-5d15-a4e5-7837d13bf93d}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 4364	3632	regsvr32.exe	82
PID 3632 wrote to memory of 4364	3632	regsvr32.exe	82
PID 3632 wrote to memory of 4364	3632	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Windows.Networking.BackgroundTransfer.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Windows.Networking.BackgroundTransfer.dll
  2⤵
  - Modifies registry class
  PID:4364

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads