a16fbf675322f9a163155cc508aa9ef87778f987991e0396a06772b0d6d30edc

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a16fbf675322f9a163155cc508aa9ef87778f987991e0396a06772b0d6d30edc.dll
Size

216KB
MD5

6e6baf0ebd362fce6c058cdd5e99436b
SHA1

08d3733cd2fb17f1738cb151ca9c9ada0c5e1f27
SHA256

a16fbf675322f9a163155cc508aa9ef87778f987991e0396a06772b0d6d30edc
SHA512

ca2f98148a63c420d4aa36f3dc219c5d53b1b2a50c5c0c5d09918d4925e37ae348f500a5b65901e3998302b78b66ec5faac077ac8ec051d25b4476822614cff5
SSDEEP

3072:8ntIpsdUoDTZ7PqQI470azkqA0gNvbGLtBFlj5u5kPQru:8ntIe6o3Z7Pqt4kqngQLtBz55

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C1}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AD}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AA}\ = "Contact"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C2}\TypeLib\ = "{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AC}\ProgID\ = "NKTWABLib.Folder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7BC}\ = "INKTWABItem"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AD}\ = "IFolders"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B0}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NKTWABLib.GroupContacts\CLSID\ = "{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B0}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AE}\ = "Folders"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7BC}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B9}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C2}\ProgID\ = "NKTWABLib.Groups"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B5}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B4}\ = "IGroupContacts"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NKTWABLib.Contact	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AC}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7BC}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AF}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NKTWABLib.Folder\ = "Folder"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A9}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A9}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NKTWABLib.NKTWABItem\ = "NKTWABItem"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a16fbf675322f9a163155cc508aa9ef87778f987991e0396a06772b0d6d30edc.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7BB}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A6}\2.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C3}\ = "IGroups"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7BA}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NKTWABLib.Groups\CLSID\ = "{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C2}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B4}\ = "IGroupContacts"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AD}\ = "IFolders"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B0}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AC}\TypeLib\ = "{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A6}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7BA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AF}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NKTWABLib.NKTWABItem\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A6}\2.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7BA}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AD}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C1}\TypeLib\Version = "2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B6}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C0}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NKTWABLib.Group\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AB}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A7}\TypeLib\ = "{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NKTWABLib.Group\CLSID\ = "{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C0}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C3}\TypeLib\ = "{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a16fbf675322f9a163155cc508aa9ef87778f987991e0396a06772b0d6d30edc.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C0}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A8}\ProgID\ = "NKTWABLib.NKTWAB"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NKTWABLib.NKTWAB\CLSID\ = "{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A8}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2448	2444	regsvr32.exe	28
PID 2444 wrote to memory of 2448	2444	regsvr32.exe	28
PID 2444 wrote to memory of 2448	2444	regsvr32.exe	28
PID 2444 wrote to memory of 2448	2444	regsvr32.exe	28
PID 2444 wrote to memory of 2448	2444	regsvr32.exe	28
PID 2444 wrote to memory of 2448	2444	regsvr32.exe	28
PID 2444 wrote to memory of 2448	2444	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a16fbf675322f9a163155cc508aa9ef87778f987991e0396a06772b0d6d30edc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a16fbf675322f9a163155cc508aa9ef87778f987991e0396a06772b0d6d30edc.dll
  2⤵
  - Modifies registry class
  PID:2448

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads