60ef801af4a8343168892d940a5718db733961ffcb2a559457f0bfc6aec8c4d7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

KSNETADSL.dll
Size

96KB
MD5

902ceeb516117952690460ec7952b316
SHA1

5df61b32d79f5208b747dd2b34beec2ae10ebbcf
SHA256

f2f6b4770718eed349fb7c77429938ac1deae7dd6bcc141ee6f5af9f4501a695
SHA512

df9ebfc33265153ffbd069549ef3171b42bf6141ebd618d657b253d70837ead7547536d9dec7bc5bcb002ae24290a3c17677a1a0db9c64edd2ec9ed8b33a9329
SSDEEP

1536:qRV7MIseFcthzzng+3p+GEiYCrMb+GrAGcM5DGV12y5rMnnPLGx38Ac:qRV4IEh3ngzGEF2Mb+GrAGcM544y+nPb

Score

1^/10

Malware Config

Signatures

Modifies registry class 58 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8AAF239-E8BB-41ED-8DD3-A4C3C5E95234}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0731B21-A1B8-4A30-AD2C-429222DDF954}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6F8DC703-E183-4E8F-AFBB-9C1770E9D844}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0731B21-A1B8-4A30-AD2C-429222DDF954}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6F8DC703-E183-4E8F-AFBB-9C1770E9D844}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6F8DC703-E183-4E8F-AFBB-9C1770E9D844}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0731B21-A1B8-4A30-AD2C-429222DDF954}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6F8DC703-E183-4E8F-AFBB-9C1770E9D844}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\Component Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}\800\ = "Safe for initializing"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0731B21-A1B8-4A30-AD2C-429222DDF954}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6F8DC703-E183-4E8F-AFBB-9C1770E9D844}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}\800	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8AAF239-E8BB-41ED-8DD3-A4C3C5E95234}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8AAF239-E8BB-41ED-8DD3-A4C3C5E95234}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0731B21-A1B8-4A30-AD2C-429222DDF954}\1.0\ = "KSNETADSL 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6F8DC703-E183-4E8F-AFBB-9C1770E9D844}\ = "IKSNETCOMADSL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KSNETADSL.KSNETCOMADSL\CLSID\ = "{B8AAF239-E8BB-41ED-8DD3-A4C3C5E95234}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}\800\ = "Safe for scripting"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8AAF239-E8BB-41ED-8DD3-A4C3C5E95234}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8AAF239-E8BB-41ED-8DD3-A4C3C5E95234}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8AAF239-E8BB-41ED-8DD3-A4C3C5E95234}\ProgID\ = "KSNETADSL.KSNETCOMADSL.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0731B21-A1B8-4A30-AD2C-429222DDF954}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6F8DC703-E183-4E8F-AFBB-9C1770E9D844}\TypeLib\ = "{F0731B21-A1B8-4A30-AD2C-429222DDF954}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8AAF239-E8BB-41ED-8DD3-A4C3C5E95234}\ = "KSNETCOMADSL Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6F8DC703-E183-4E8F-AFBB-9C1770E9D844}\ = "IKSNETCOMADSL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6F8DC703-E183-4E8F-AFBB-9C1770E9D844}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0731B21-A1B8-4A30-AD2C-429222DDF954}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6F8DC703-E183-4E8F-AFBB-9C1770E9D844}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KSNETADSL.KSNETCOMADSL.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KSNETADSL.KSNETCOMADSL\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KSNETADSL.KSNETCOMADSL\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6F8DC703-E183-4E8F-AFBB-9C1770E9D844}\TypeLib\ = "{F0731B21-A1B8-4A30-AD2C-429222DDF954}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8AAF239-E8BB-41ED-8DD3-A4C3C5E95234}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8AAF239-E8BB-41ED-8DD3-A4C3C5E95234}\VersionIndependentProgID\ = "KSNETADSL.KSNETCOMADSL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6F8DC703-E183-4E8F-AFBB-9C1770E9D844}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8AAF239-E8BB-41ED-8DD3-A4C3C5E95234}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8AAF239-E8BB-41ED-8DD3-A4C3C5E95234}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8AAF239-E8BB-41ED-8DD3-A4C3C5E95234}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0731B21-A1B8-4A30-AD2C-429222DDF954}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6F8DC703-E183-4E8F-AFBB-9C1770E9D844}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KSNETADSL.KSNETCOMADSL.1\CLSID\ = "{B8AAF239-E8BB-41ED-8DD3-A4C3C5E95234}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KSNETADSL.KSNETCOMADSL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8AAF239-E8BB-41ED-8DD3-A4C3C5E95234}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KSNETADSL.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8AAF239-E8BB-41ED-8DD3-A4C3C5E95234}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8AAF239-E8BB-41ED-8DD3-A4C3C5E95234}\TypeLib\ = "{F0731B21-A1B8-4A30-AD2C-429222DDF954}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0731B21-A1B8-4A30-AD2C-429222DDF954}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KSNETADSL.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6F8DC703-E183-4E8F-AFBB-9C1770E9D844}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KSNETADSL.KSNETCOMADSL\ = "KSNETCOMADSL Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KSNETADSL.KSNETCOMADSL\CurVer\ = "KSNETADSL.KSNETCOMADSL.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0731B21-A1B8-4A30-AD2C-429222DDF954}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KSNETADSL.KSNETCOMADSL.1\ = "KSNETCOMADSL Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KSNETADSL.KSNETCOMADSL.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}\800	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1724	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1724	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1724	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1724	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1724	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1724	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1724	1928	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\KSNETADSL.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\KSNETADSL.dll
  2⤵
  - Modifies registry class
  PID:1724

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads