71adc882c04d3971db6186a8630db425c571b8db6403036745e86b53bf1d3474

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

File/CryptoKit.SDEG.x86.dll
Size

1.1MB
MD5

8b0b7f6b9b8df86944d0222229d68816
SHA1

8c92080de0f48fd932834a76c7dc20c195320cde
SHA256

7911ed26af8ad6dbc04e3cfce489c888e18724d41ff878051936bb2fde6f5ebe
SHA512

1472edb3081262ef46702b13ebb8ef6bf7aeba68c2a739efa4e21b83a63a8575291d65eb94457f3fef355da57742c5976f37a1161b411e21ddb5a610b0ec623d
SSDEEP

24576:dsegze2uMa6Ji9PULxI9XSFW5s0kI/xBdTlCQPb1+:jgS2NfVI9Ev0j/DdpD1+

Score

1^/10

Malware Config

Signatures

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EE5E54C-021A-49CB-830E-3C3159CCE2EF}\ProgID\ = "CryptoKit.CryptoAgent.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE17CEE1-C1EE-41B1-99ED-63416061190F}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E64AF12-53D0-467E-99D5-2BAFBE9F85F0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E64AF12-53D0-467E-99D5-2BAFBE9F85F0}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E64AF12-53D0-467E-99D5-2BAFBE9F85F0}\TypeLib\ = "{FE17CEE1-C1EE-41B1-99ED-63416061190F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E64AF12-53D0-467E-99D5-2BAFBE9F85F0}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent.1\CLSID\ = "{5EE5E54C-021A-49CB-830E-3C3159CCE2EF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent\ = "CryptoAgent Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EE5E54C-021A-49CB-830E-3C3159CCE2EF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\File\\CryptoKit.SDEG.x86.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE17CEE1-C1EE-41B1-99ED-63416061190F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE17CEE1-C1EE-41B1-99ED-63416061190F}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E64AF12-53D0-467E-99D5-2BAFBE9F85F0}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent.1\ = "CryptoAgent Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent\CLSID\ = "{5EE5E54C-021A-49CB-830E-3C3159CCE2EF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EE5E54C-021A-49CB-830E-3C3159CCE2EF}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EE5E54C-021A-49CB-830E-3C3159CCE2EF}\VersionIndependentProgID\ = "CryptoKit.CryptoAgent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EE5E54C-021A-49CB-830E-3C3159CCE2EF}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE17CEE1-C1EE-41B1-99ED-63416061190F}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE17CEE1-C1EE-41B1-99ED-63416061190F}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E64AF12-53D0-467E-99D5-2BAFBE9F85F0}\ = "ICryptoAgent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE17CEE1-C1EE-41B1-99ED-63416061190F}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\File\\CryptoKit.SDEG.x86.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EE5E54C-021A-49CB-830E-3C3159CCE2EF}\ = "CryptoAgent Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EE5E54C-021A-49CB-830E-3C3159CCE2EF}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE17CEE1-C1EE-41B1-99ED-63416061190F}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE17CEE1-C1EE-41B1-99ED-63416061190F}\1.0\ = "CryptoKit.SDEG.x86 3.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE17CEE1-C1EE-41B1-99ED-63416061190F}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E64AF12-53D0-467E-99D5-2BAFBE9F85F0}\ = "ICryptoAgent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent\CurVer\ = "CryptoKit.CryptoAgent.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E64AF12-53D0-467E-99D5-2BAFBE9F85F0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E64AF12-53D0-467E-99D5-2BAFBE9F85F0}\TypeLib\ = "{FE17CEE1-C1EE-41B1-99ED-63416061190F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EE5E54C-021A-49CB-830E-3C3159CCE2EF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE17CEE1-C1EE-41B1-99ED-63416061190F}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\File"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E64AF12-53D0-467E-99D5-2BAFBE9F85F0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E64AF12-53D0-467E-99D5-2BAFBE9F85F0}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EE5E54C-021A-49CB-830E-3C3159CCE2EF}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EE5E54C-021A-49CB-830E-3C3159CCE2EF}\TypeLib\ = "{FE17CEE1-C1EE-41B1-99ED-63416061190F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E64AF12-53D0-467E-99D5-2BAFBE9F85F0}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E64AF12-53D0-467E-99D5-2BAFBE9F85F0}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E64AF12-53D0-467E-99D5-2BAFBE9F85F0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EE5E54C-021A-49CB-830E-3C3159CCE2EF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5EE5E54C-021A-49CB-830E-3C3159CCE2EF}\ProgID	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2204	1688	regsvr32.exe	28
PID 1688 wrote to memory of 2204	1688	regsvr32.exe	28
PID 1688 wrote to memory of 2204	1688	regsvr32.exe	28
PID 1688 wrote to memory of 2204	1688	regsvr32.exe	28
PID 1688 wrote to memory of 2204	1688	regsvr32.exe	28
PID 1688 wrote to memory of 2204	1688	regsvr32.exe	28
PID 1688 wrote to memory of 2204	1688	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\File\CryptoKit.SDEG.x86.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\File\CryptoKit.SDEG.x86.dll
  2⤵
  - Modifies registry class
  PID:2204

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads