0d13dd9df82ec9d8b778815ae9634d8ab63a1facd76de25d406e33aa44b0aecf

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GF.dll
Size 2.2MB
Sample240601-p5e7cade87
SHA256 aaec4f9f9e189ca99f5a6e8f6d796d99accb739bdba83d6a3e8ec966d1bdfa93
MD5 6fb4c7fe75ab3b8196c9e3b3c15740fb
SHA1 568a102150f8ebd963c45c9157b937b6dc7083a3
SHA512 b831a94088fd4b5192664f2fd374d6e85a8cec4d67bf8ffdb590d09b7d8a06924aea75785dc9199dd14f2b90fdff6b926bf147402aefd90189dd38631e6b03a4
SSDEEP 49152:gyWXbjxiiW0umc6CBjS+iaCYtm3lL7Wwqo2wordDQwM:gyWXbnc7B++iaz8ordDQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoRichStatic\CurVer\ = "TXGF.CGFCoRichStatic.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9FCC97CB-8125-4AB9-A2A6-4FFBDBF348BC}\InprocServer32\ThreadingModel = "free"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoRichStaticEx.1\ = "CGFCoRichStaticEx Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CC39FDF-4CA4-4A40-8DFA-EAA0153DA023}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C9F0260C-102F-4D83-A1A5-9A2EE960713A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GF.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoModeNormal\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{75E0649F-C576-499e-8193-3115B58DAF8E}\AppID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9DD9213D-193B-43B6-8EE0-2171AF10C520}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D81A87D-D4ED-4078-84D5-AA01B9E6D047}\VersionIndependentProgID\ = "TXGF.CGFCoGFBubbleTip"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9FD5283B-326B-4555-8C82-DFA3A74888F6}\AppID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5e4ee187-dc49-459d-8d3b-470b97da4623}\ProgID\ = "TXGF.CGFMessageRoute.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4A9FF99-5C71-41A6-8200-1BC21D3B9A30}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{918222BB-2D93-47F2-8EBF-D299D5F4A7C3}\VersionIndependentProgID\ = "TXGF.CGFFontEffect"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{993A43F7-C493-4551-AEC0-A445AE6C4F9D}\InprocServer32\ThreadingModel = "free"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CGFCoTabCtrlExtLogic.CGFCoTabCtrlExtL.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CGFCoFont\CLSID\ = "{A3914F27-FA9D-4410-A265-24C9ED0558FD}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E59CE0F8-E42A-47F8-9BE5-C3C2C03770A7}\TypeLib\ = "{47EAC20F-C10B-485D-8807-F06FD35912B8}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoComboBox\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoPostMessage\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoDropView\CLSID\ = "{8A880738-745D-48E8-B23F-7592718C3232}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CIEActiveXContainer.CIEActiveXContain.1\CLSID\ = "{B27D5CC4-C1DD-4D5F-AE06-DBE2A34D9567}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39393A6F-57F7-48D6-9751-4414BDD606B6}\TypeLib\ = "{47EAC20F-C10B-485D-8807-F06FD35912B8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoSlider\CLSID\ = "{36911EBC-CD98-45FC-96D6-CEA3FFFF3A00}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoTabButton\ = "CGFCoTabButton Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoRectChangeAnimation\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFIE.1\ = "CGFCoIE Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7870ECBF-B3E0-4869-AF87-115CD895E188}\AppID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CC39FDF-4CA4-4A40-8DFA-EAA0153DA023}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoSlider	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoTreeItem\ = "CGFCoTreeItem Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{247362C4-BC4E-4b68-BD39-E7982B53F4C5}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CCoSimpleTypeInfo\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoComboButton\CurVer\ = "TXGF.CGFCoComboButton.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoRichStatic\CLSID\ = "{A9D98E2C-E9CB-434E-8A22-4BBC5AA7893C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A9D98E2C-E9CB-434E-8A22-4BBC5AA7893C}\ProgID\ = "TXGF.CGFCoRichStatic.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{247362C4-BC4E-4b68-BD39-E7982B53F4C5}\TypeLib\ = "{47EAC20F-C10B-485D-8807-F06FD35912B8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFColorizeSupporter\CLSID\ = "{B4A9FF99-5C71-41A6-8200-1BC21D3B9A30}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CGFCoElementExtLogic.CGFCoElementExtL\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CGFCoFont.1\CLSID\ = "{A3914F27-FA9D-4410-A265-24C9ED0558FD}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DE707F2-00E2-4CE9-8D23-757A545B8BE8}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoStandardWin\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoGifAnimation\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoMessageBox2\ = "CGFCoMessageBox2 Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoWin	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{449FAEC7-C59F-40BD-BAC8-DCB34DED20AE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GF.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB34FEA8-180A-4641-B6CB-F8AFD0E0B7BC}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GF.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CGFCoBrush\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CGFCoFont\ = "CGFCoFont Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4955F227-D948-41A7-87A0-DC2849D5C7CE}\InprocServer32\ThreadingModel = "apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoComboBox\ = "CGFCoComboBox Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F7C067DF-0D33-4304-9EC5-8F5A2270D837}\ProgID\ = "CGFCoMenuExtLogic.CGFCoMenuExtLogic.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7D4A6E33-ACF5-4BA4-AC1A-2A2E21F1CA71}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoMenuWindow\CLSID\ = "{AA7A74AD-57EA-4CB3-9B10-752FC073E652}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F541EBB-0FB3-4EC0-B01C-E99A557B79FA}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F3859B46-80F5-4825-90E7-C2E20121C4CA}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A9D98E2C-E9CB-434E-8A22-4BBC5AA7893C}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9DD9213D-193B-43B6-8EE0-2171AF10C520}\VersionIndependentProgID\ = "CFlashContainer.CFlashContainer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoScrollView.1\ = "CGFCoScrollView Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9FCC97CB-8125-4AB9-A2A6-4FFBDBF348BC}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{817984B0-2757-4002-88ED-9C82A40FB321}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GF.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F7A92F9A-EBF1-43C6-A308-0815726D9651}\ = "CGFCoIE Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoConfigAgent\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4955F227-D948-41A7-87A0-DC2849D5C7CE}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoCheckButton.1\ = "CGFCoCheckButton Object"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2956	2204	regsvr32.exe	28
PID 2204 wrote to memory of 2956	2204	regsvr32.exe	28
PID 2204 wrote to memory of 2956	2204	regsvr32.exe	28
PID 2204 wrote to memory of 2956	2204	regsvr32.exe	28
PID 2204 wrote to memory of 2956	2204	regsvr32.exe	28
PID 2204 wrote to memory of 2956	2204	regsvr32.exe	28
PID 2204 wrote to memory of 2956	2204	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\GF.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\GF.dll
  2⤵
  - Modifies registry class
  PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2956-0-0x00000000001D0000-0x00000000001F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads