0d13dd9df82ec9d8b778815ae9634d8ab63a1facd76de25d406e33aa44b0aecf

Analysis

max time kernel
134s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GF.dll
Size 2.2MB
Sample240601-p5e7cade87
SHA256 aaec4f9f9e189ca99f5a6e8f6d796d99accb739bdba83d6a3e8ec966d1bdfa93
MD5 6fb4c7fe75ab3b8196c9e3b3c15740fb
SHA1 568a102150f8ebd963c45c9157b937b6dc7083a3
SHA512 b831a94088fd4b5192664f2fd374d6e85a8cec4d67bf8ffdb590d09b7d8a06924aea75785dc9199dd14f2b90fdff6b926bf147402aefd90189dd38631e6b03a4
SSDEEP 49152:gyWXbjxiiW0umc6CBjS+iaCYtm3lL7Wwqo2wordDQwM:gyWXbnc7B++iaz8ordDQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4568	1756	WerFault.exe	89

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C597BCB-9FDF-4f01-BD64-EB850C5FC9C2}\InprocServer32\ThreadingModel = "apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3F65A6C-1944-4B47-A333-FA0E3FE438F4}\InprocServer32\ThreadingModel = "free"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC1E4C13-88C2-4DA5-805A-215F814F36E4}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F7C067DF-0D33-4304-9EC5-8F5A2270D837}\InprocServer32\ThreadingModel = "free"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20BB9542-E499-4618-9E2D-079A06FD99B0}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE6962DE-F924-49f2-97C0-5E3AC8771285}\ProgID\ = "TXGF.IGFMetadataMgr.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6F0AE27-F538-4c0d-BD8C-1210A45A9D04}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoPostMessage\CurVer\ = "TXGF.CGFCoPostMessage.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3859B46-80F5-4825-90E7-C2E20121C4CA}\AppID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04836C26-DEAF-4E89-8770-B529E500538D}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF7FDB49-A0F7-44a5-97DD-2703F5B29A24}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CGFCoComboBoxList2.CGFCoComboBoxLis\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{140AD1D0-EBF2-4A8A-9D2E-AA71CF023DF9}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFIE\ = "CGFCoIE Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFHotKey\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55E6DC81-7F66-4b29-9483-1B36C6792A42}\AppID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61E55331-CB9B-4B1A-98F7-24E839A4AD3B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6352C08-0E5F-4ADE-AB65-9410436ADCC5}\ProgID\ = "CGFCoFontString.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DCF94C84-40C3-4EA3-B616-6B675DF4ACCD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFOleDataObject.1\ = "CGFCoOleDataObject Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{817984B0-2757-4002-88ED-9C82A40FB321}\ = "CGFCoRadioButtonGroup Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCanvasControl.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B27D5CC4-C1DD-4D5F-AE06-DBE2A34D9567}\InprocServer32\ThreadingModel = "free"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDA0ED51-B482-4A5B-A2B4-31A31768CD1D}\AppID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33B9D281-CF37-464E-947C-AB23DF296F1F}\VersionIndependentProgID\ = "CCoArrayTypeInfo"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoToolbar\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoComboBox2\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoWndFrame.1\CLSID\ = "{A2591F08-7A68-42C1-BE69-A0BB93665A71}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2591F08-7A68-42C1-BE69-A0BB93665A71}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F830C011-494F-41ac-84CB-C7EECB281EE9}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971D340D-FCDB-430D-AFB8-E29A9F6B5A10}\TypeLib\ = "{47EAC20F-C10B-485D-8807-F06FD35912B8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CGFCoTexture.1\ = "CGFCoTexture Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCCEF5D6-13AC-4DA8-A3D2-58722B567460}\VersionIndependentProgID\ = "TXGF.CGFCoProgress"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CGFCoContainerExtLogic.CGFCoContainer\CLSID\ = "{993A43F7-C493-4551-AEC0-A445AE6C4F9D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D81A87D-D4ED-4078-84D5-AA01B9E6D047}\TypeLib\ = "{47EAC20F-C10B-485D-8807-F06FD35912B8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoDropView.1\ = "CGFCoDropView Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBF2A1D0-F849-4627-92FF-9A9A3FEF9BCF}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F9A3BC7-AEFB-4B17-8D02-27D8965B8E24}\VersionIndependentProgID\ = "TXGF.CGFCoGridPanel"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoMutexLogic.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26F1A889-7BCD-490C-AAFA-7429DF1062DF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GF.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoTopgroundAnimation\CLSID\ = "{901C5B14-FADC-4E09-ADEC-7BD0CC78C67C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4955F227-D948-41A7-87A0-DC2849D5C7CE}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoScrollView\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F7C067DF-0D33-4304-9EC5-8F5A2270D837}\TypeLib\ = "{47EAC20F-C10B-485D-8807-F06FD35912B8}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB22E252-3B64-4438-9C1F-B482B0990C7C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5e4ee187-dc49-459d-8d3b-470b97da4623}\ = "CGFCoMessageRoute Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{449FAEC7-C59F-40BD-BAC8-DCB34DED20AE}\AppID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CGFCoControlExtLogic.CGFCoControlExtL	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE6962DE-F924-49f2-97C0-5E3AC8771285}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{86FF4BAF-F39A-4986-BE82-5A2762D255E9}\VersionIndependentProgID\ = "TXGF.CGFCoCheckButton"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D29BD05-FACE-465c-9FEB-A37E33A882A8}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoComboBoxPearlItem.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoComboBoxTip2\CLSID\ = "{EC1E4C13-88C2-4DA5-805A-215F814F36E4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{86E1FEB3-72E5-4ea0-ABA6-9F0246194C95}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E9B28D8-B8BA-4186-95DB-0D63F6797CD3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoTopgroundAnimation.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2398405-030C-4F04-A817-50B8DCC673E9}\VersionIndependentProgID\ = "TXGF.CGFCoRichStatic"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84796287-37F5-40E7-A151-04F1D2F7BB70}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GF.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CIEActiveXContainer.CIEActiveXContain\CLSID\ = "{B27D5CC4-C1DD-4D5F-AE06-DBE2A34D9567}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F541EBB-0FB3-4EC0-B01C-E99A557B79FA}\TypeLib\ = "{47EAC20F-C10B-485D-8807-F06FD35912B8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D308D57-B86C-4053-91F4-CA3F0188C644}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GF.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TXGF.CGFCoRadioButtonGroup.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FD5283B-326B-4555-8C82-DFA3A74888F6}\ProgID\ = "TXGF.CGFCoSpinControl.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DAACA8D9-1973-4905-AF93-494E69F4AC52}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GF.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1756	1536	regsvr32.exe	89
PID 1536 wrote to memory of 1756	1536	regsvr32.exe	89
PID 1536 wrote to memory of 1756	1536	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\GF.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\GF.dll
  2⤵
  - Modifies registry class
  PID:1756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 980
    3⤵
    - Program crash
    PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1756 -ip 1756
1⤵
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4212,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8
1⤵
PID:4616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-0-0x0000000000CF0000-0x0000000000D15000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads