a16fbf675322f9a163155cc508aa9ef87778f987991e0396a06772b0d6d30edc

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a16fbf675322f9a163155cc508aa9ef87778f987991e0396a06772b0d6d30edc.dll
Size

216KB
MD5

6e6baf0ebd362fce6c058cdd5e99436b
SHA1

08d3733cd2fb17f1738cb151ca9c9ada0c5e1f27
SHA256

a16fbf675322f9a163155cc508aa9ef87778f987991e0396a06772b0d6d30edc
SHA512

ca2f98148a63c420d4aa36f3dc219c5d53b1b2a50c5c0c5d09918d4925e37ae348f500a5b65901e3998302b78b66ec5faac077ac8ec051d25b4476822614cff5
SSDEEP

3072:8ntIpsdUoDTZ7PqQI470azkqA0gNvbGLtBFlj5u5kPQru:8ntIe6o3Z7Pqt4kqngQLtBz55

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AB}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A6}\2.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B4}\TypeLib\Version = "2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A7}\ = "INKTWAB"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NKTWABLib.Contact	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AF}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C3}\ = "IGroups"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7BA}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NKTWABLib.NKTWABItem\ = "NKTWABItem"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B0}\TypeLib\ = "{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C0}\ = "Group"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AC}\ProgID\ = "NKTWABLib.Folder"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7BC}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C3}\TypeLib\ = "{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A6}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A7}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7BC}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C3}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AD}\ = "IFolders"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a16fbf675322f9a163155cc508aa9ef87778f987991e0396a06772b0d6d30edc.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AC}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A8}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C1}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NKTWABLib.Contacts\CLSID\ = "{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C0}\ProgID\ = "NKTWABLib.Group"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NKTWABLib.NKTWAB	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A9}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AF}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B4}\TypeLib\ = "{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A6}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A9}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A9}\TypeLib\ = "{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NKTWABLib.ContactContainer\ = "ContactContainer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7BA}\TypeLib\ = "{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AB}\TypeLib\ = "{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A6}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A7}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C2}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7BC}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AF}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a16fbf675322f9a163155cc508aa9ef87778f987991e0396a06772b0d6d30edc.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NKTWABLib.FolderContacts	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B6}\ = "FolderContacts"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NKTWABLib.Group\CLSID\ = "{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C0}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7BA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AA}\ = "Contact"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B0}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B4}\TypeLib\ = "{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7BA}\ = "IContactContainer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B6}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7BB}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a16fbf675322f9a163155cc508aa9ef87778f987991e0396a06772b0d6d30edc.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7AF}\ = "IContacts"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B4}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B4}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7B9}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C0}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7C0}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7BA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A7}\ = "INKTWAB"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A7}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A7}\TypeLib\ = "{9E1DFDCF-6AEF-4166-A5D7-82D6F47BD7A6}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NKTWABLib.FolderContacts\CLSID	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 1992	5024	regsvr32.exe	83
PID 5024 wrote to memory of 1992	5024	regsvr32.exe	83
PID 5024 wrote to memory of 1992	5024	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a16fbf675322f9a163155cc508aa9ef87778f987991e0396a06772b0d6d30edc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a16fbf675322f9a163155cc508aa9ef87778f987991e0396a06772b0d6d30edc.dll
  2⤵
  - Modifies registry class
  PID:1992

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads