0c860b7f821fc9d1ac0d91410201743febcf459b95c848529a8f816a9309a240

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TDVaCom.dll
Size 242KB
Sample240612-2t4f1stfmg
SHA256 b7429661268bb07d7662c492957f82ecbf60e62290235b1f491ea999a8a25983
MD5 2da6a76c8cdb10662b0d7baf5e1c09e5
SHA1 68d128ce33bea58fef560a6247a5f83dc7aac2b2
SHA512 1c79f7d67c7aaa286694d9406f849db2781e0bfcbb973502ac3bdc19d7ea8751bfc2ad9abe254323b2ac4056df0eb0eb71a002522d6b23e68d15f42f76503278
SSDEEP 3072:NrMSnRxQD+vYGrMDqB5BfG8KMm15OTDSqUCXdLCcan1p07+rq+ghQxgDXTmt7SS:NQSIDoMmB5Be8KLHOfSiXcc3UtVgDQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies registry class 42 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30A6A577-75E1-45B6-B10D-C90565FB63CA}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5C30BA06-B05B-4DCD-8F12-0A956E275CB3}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5C30BA06-B05B-4DCD-8F12-0A956E275CB3}\ = "IApplication"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VaCom.Application\ = "VaCom.Application"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30A6A577-75E1-45B6-B10D-C90565FB63CA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5C30BA06-B05B-4DCD-8F12-0A956E275CB3}\ = "IApplication"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5C30BA06-B05B-4DCD-8F12-0A956E275CB3}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VaCom.Application\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30A6A577-75E1-45B6-B10D-C90565FB63CA}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30A6A577-75E1-45B6-B10D-C90565FB63CA}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TDVaCom.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5C30BA06-B05B-4DCD-8F12-0A956E275CB3}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5C30BA06-B05B-4DCD-8F12-0A956E275CB3}\TypeLib\ = "{30A6A577-75E1-45B6-B10D-C90565FB63CA}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51E88884-1306-4444-B22D-C34119E44232}\ = "VaCom.Application"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30A6A577-75E1-45B6-B10D-C90565FB63CA}\1.0\HELPDIR\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5C30BA06-B05B-4DCD-8F12-0A956E275CB3}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VaCom.Application\CLSID\ = "{51E88884-1306-4444-B22D-C34119E44232}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51E88884-1306-4444-B22D-C34119E44232}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A74798A-B11B-4EF3-8D29-D440DC5D7B2A}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30A6A577-75E1-45B6-B10D-C90565FB63CA}\1.0\ = "VaCom"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5C30BA06-B05B-4DCD-8F12-0A956E275CB3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5C30BA06-B05B-4DCD-8F12-0A956E275CB3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5C30BA06-B05B-4DCD-8F12-0A956E275CB3}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VaCom.Application	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30A6A577-75E1-45B6-B10D-C90565FB63CA}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30A6A577-75E1-45B6-B10D-C90565FB63CA}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5C30BA06-B05B-4DCD-8F12-0A956E275CB3}\TypeLib\ = "{30A6A577-75E1-45B6-B10D-C90565FB63CA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5C30BA06-B05B-4DCD-8F12-0A956E275CB3}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51E88884-1306-4444-B22D-C34119E44232}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A74798A-B11B-4EF3-8D29-D440DC5D7B2A}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30A6A577-75E1-45B6-B10D-C90565FB63CA}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5C30BA06-B05B-4DCD-8F12-0A956E275CB3}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51E88884-1306-4444-B22D-C34119E44232}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TDVaCom.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A74798A-B11B-4EF3-8D29-D440DC5D7B2A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A74798A-B11B-4EF3-8D29-D440DC5D7B2A}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{30A6A577-75E1-45B6-B10D-C90565FB63CA}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5C30BA06-B05B-4DCD-8F12-0A956E275CB3}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51E88884-1306-4444-B22D-C34119E44232}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51E88884-1306-4444-B22D-C34119E44232}\ProgID\ = "VaCom.Application"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{51E88884-1306-4444-B22D-C34119E44232}\InProcServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 3152	1064	regsvr32.exe	83
PID 1064 wrote to memory of 3152	1064	regsvr32.exe	83
PID 1064 wrote to memory of 3152	1064	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\TDVaCom.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\TDVaCom.dll
  2⤵
  - Modifies registry class
  PID:3152

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads