671ab212adb2cbc06643b13f372fbe130e944151ff551ab07a75a34733bcfc6a

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

671ab212adb2cbc06643b13f372fbe130e944151ff551ab07a75a34733bcfc6a.dll
Size

219KB
MD5

dee33e0c7e2e056ab6376fa2d223bb8f
SHA1

8808894716565a3220b631e9ff08ac3a3b8d4901
SHA256

671ab212adb2cbc06643b13f372fbe130e944151ff551ab07a75a34733bcfc6a
SHA512

85d153c6328a5c151be43c151787adb974aa21ba70303dbfcd65d95e5ebc2123ad9c3f11d314237f6c4d0169f76024a5caa4ac75adf8135818342351d7c442e3
SSDEEP

6144:XKWDJk/cJvSkk3X30Q8QULnqK3omUIonle/JuRa8L9ByPlw:/JucRSkk3X30tBn6mUFnl3naC

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/2748-0-0x0000000011000000-0x0000000011141000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2748-0-0x0000000011000000-0x0000000011141000-memory.dmp	upx

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B30171B3-FEF1-45E5-B400-8D7B31B8FD8B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0556DC27-F9A6-4C42-B784-19E6D346411A}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{709F80D5-AB69-4628-805F-B189288D3764}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\671ab212adb2cbc06643b13f372fbe130e944151ff551ab07a75a34733bcfc6a.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CAE26C39-6759-47A6-B411-D57021095357}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBB42E12-8272-4B36-96BF-0739E7834422}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBB42E12-8272-4B36-96BF-0739E7834422}\TypeLib\ = "{8C395DC0-942C-4238-AE10-2730D97E51C8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PE_Space6.User_SpaceLink\Clsid\ = "{C38E2294-0399-4718-A6CF-DFAFCC0F7C3D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B30171B3-FEF1-45E5-B400-8D7B31B8FD8B}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PE_Space6.User_SpaceDiary\Clsid\ = "{18438E79-1CC0-4B2E-BC1E-8A6AB9B8BB9D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18438E79-1CC0-4B2E-BC1E-8A6AB9B8BB9D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DBF84369-0130-4B07-A8AB-2159D30D0EC3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PE_Space6.Admin_Common	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68CEFAB4-5CAF-49C0-B2FB-8A51ABCCEA29}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1137CA72-D59A-45A7-8C81-6D8FCCA175C8}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{709F80D5-AB69-4628-805F-B189288D3764}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1E10C7A-89A6-4A7B-BA8A-A98624572AC1}\TypeLib\ = "{8C395DC0-942C-4238-AE10-2730D97E51C8}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6E98E3E8-61AC-43ED-B9CC-AFA305DF713F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{73719538-0F70-475A-8410-4CA04306F68C}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2031E110-9537-4794-8CDA-C025A1B69BAF}\VERSION	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1137CA72-D59A-45A7-8C81-6D8FCCA175C8}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18438E79-1CC0-4B2E-BC1E-8A6AB9B8BB9D}\VERSION\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6E98E3E8-61AC-43ED-B9CC-AFA305DF713F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFFC9952-DB66-4E48-9217-165CD541B9AD}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B30171B3-FEF1-45E5-B400-8D7B31B8FD8B}\ = "User_SpaceBook"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0556DC27-F9A6-4C42-B784-19E6D346411A}\ = "_Cache"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1137CA72-D59A-45A7-8C81-6D8FCCA175C8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\671ab212adb2cbc06643b13f372fbe130e944151ff551ab07a75a34733bcfc6a.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PE_Space6.User_SpaceDiary\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CAE26C39-6759-47A6-B411-D57021095357}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CAE26C39-6759-47A6-B411-D57021095357}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAE26C39-6759-47A6-B411-D57021095357}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0556DC27-F9A6-4C42-B784-19E6D346411A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PE_Space6.User_SpaceDiary	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADAB03A0-E6F7-4441-8F0E-29B8E0D7E61D}\ = "_ShowBlog"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{459D051E-9F60-42C2-B8F8-976590628873}\ = "_Admin_SpaceManage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F891A5AE-53FB-4276-95FE-D92084F8E026}\ = "RSA"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PE_Space6.User_Space\ = "PE_Space6.User_Space"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFFC9952-DB66-4E48-9217-165CD541B9AD}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1137CA72-D59A-45A7-8C81-6D8FCCA175C8}\TypeLib\ = "{8C395DC0-942C-4238-AE10-2730D97E51C8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBB42E12-8272-4B36-96BF-0739E7834422}\ = "_User_SpaceLink"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFFC9952-DB66-4E48-9217-165CD541B9AD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D4C67F1-6EA0-4FBA-8D89-7BF754E3D063}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7595984-4CE8-4D1B-8781-7D5CF288E884}\VERSION\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B30171B3-FEF1-45E5-B400-8D7B31B8FD8B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{73719538-0F70-475A-8410-4CA04306F68C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\671ab212adb2cbc06643b13f372fbe130e944151ff551ab07a75a34733bcfc6a.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2031E110-9537-4794-8CDA-C025A1B69BAF}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBB42E12-8272-4B36-96BF-0739E7834422}\ = "User_SpaceLink"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C395DC0-942C-4238-AE10-2730D97E51C8}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\671ab212adb2cbc06643b13f372fbe130e944151ff551ab07a75a34733bcfc6a.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ADAB03A0-E6F7-4441-8F0E-29B8E0D7E61D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91E90E3C-4C5D-4103-B413-FFA20B81FBAC}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFFC9952-DB66-4E48-9217-165CD541B9AD}\VERSION\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D4C67F1-6EA0-4FBA-8D89-7BF754E3D063}\VERSION\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB9DAC36-A9D5-4BBA-85D0-EC701FB949A4}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PE_Space6.Admin_SpaceManage\Clsid\ = "{709F80D5-AB69-4628-805F-B189288D3764}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0556DC27-F9A6-4C42-B784-19E6D346411A}\ = "_Cache"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B0A17848-B78B-4F98-B43F-979618263B46}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{73719538-0F70-475A-8410-4CA04306F68C}\ = "PE_Space6.Md5_Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91E90E3C-4C5D-4103-B413-FFA20B81FBAC}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B30171B3-FEF1-45E5-B400-8D7B31B8FD8B}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1E10C7A-89A6-4A7B-BA8A-A98624572AC1}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F891A5AE-53FB-4276-95FE-D92084F8E026}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2031E110-9537-4794-8CDA-C025A1B69BAF}\TypeLib\ = "{8C395DC0-942C-4238-AE10-2730D97E51C8}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B30171B3-FEF1-45E5-B400-8D7B31B8FD8B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B0A17848-B78B-4F98-B43F-979618263B46}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D4C67F1-6EA0-4FBA-8D89-7BF754E3D063}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2748	1244	regsvr32.exe	91
PID 1244 wrote to memory of 2748	1244	regsvr32.exe	91
PID 1244 wrote to memory of 2748	1244	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\671ab212adb2cbc06643b13f372fbe130e944151ff551ab07a75a34733bcfc6a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\671ab212adb2cbc06643b13f372fbe130e944151ff551ab07a75a34733bcfc6a.dll
  2⤵
  - Modifies registry class
  PID:2748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4352 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:4348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2748-0-0x0000000011000000-0x0000000011141000-memory.dmp

Filesize
1.3MB

Download