1743c09774c8aa85ea6463bf48def681e4ccf13660620e7378ecd9df6c33169b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fish-v327-0221/kini/SWFToImage.dll
Size

672KB
MD5

6b1e5a2290a9f9323b197dab25e8af47
SHA1

038944d036e7b3d128e2eeaa156a3c6348cf4372
SHA256

5021a3de51dc47b909a4cef8a81f619bbdac4f9b123d2d71c7aa5c6a20f66685
SHA512

b427a33728e69a5bc4b60904156b6bac4c3d505daf7dc41524aed1e2fdf14779924354ee81ff3be7ba22e29fe488969c07f484273d2fc6b23a0fdd23283d9762
SSDEEP

12288:whREIgt1FN1oC4xgxjcGw2sOU7F3MFMUs/oeQ4iuDzYyqo+G:oSIgXT1/4xgxIGwiMF8FoA6iuDzJ

Score

1^/10

Malware Config

Signatures

Modifies registry class 39 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7445F31D-8956-43AF-88B7-1C5FF7AAE1F5}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7445F31D-8956-43AF-88B7-1C5FF7AAE1F5}\ = "ISWFToImageObject"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SWFToImage.SWFToImageObject\ = "SWFToImageObject Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{479A1AAC-C148-40BB-9868-A9773DA66AF9}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F52B2898-3CD9-4530-8F1E-2762A2783C33}\1.0\ = "SWFToImageScout Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F52B2898-3CD9-4530-8F1E-2762A2783C33}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F52B2898-3CD9-4530-8F1E-2762A2783C33}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Fish-v327-0221\\kini\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7445F31D-8956-43AF-88B7-1C5FF7AAE1F5}\TypeLib\ = "{F52B2898-3CD9-4530-8F1E-2762A2783C33}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{479A1AAC-C148-40BB-9868-A9773DA66AF9}\ProgID\ = "SWFToImage.SWFToImageObject"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{479A1AAC-C148-40BB-9868-A9773DA66AF9}\ = "SWFToImageObject Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SWFToImage.SWFToImageObject	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{479A1AAC-C148-40BB-9868-A9773DA66AF9}\TypeLib\ = "{F52B2898-3CD9-4530-8F1E-2762A2783C33}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F52B2898-3CD9-4530-8F1E-2762A2783C33}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F52B2898-3CD9-4530-8F1E-2762A2783C33}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Fish-v327-0221\\kini\\SWFToImage.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7445F31D-8956-43AF-88B7-1C5FF7AAE1F5}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7445F31D-8956-43AF-88B7-1C5FF7AAE1F5}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F52B2898-3CD9-4530-8F1E-2762A2783C33}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7445F31D-8956-43AF-88B7-1C5FF7AAE1F5}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7445F31D-8956-43AF-88B7-1C5FF7AAE1F5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7445F31D-8956-43AF-88B7-1C5FF7AAE1F5}\TypeLib\ = "{F52B2898-3CD9-4530-8F1E-2762A2783C33}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{479A1AAC-C148-40BB-9868-A9773DA66AF9}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{479A1AAC-C148-40BB-9868-A9773DA66AF9}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7445F31D-8956-43AF-88B7-1C5FF7AAE1F5}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7445F31D-8956-43AF-88B7-1C5FF7AAE1F5}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7445F31D-8956-43AF-88B7-1C5FF7AAE1F5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{479A1AAC-C148-40BB-9868-A9773DA66AF9}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{479A1AAC-C148-40BB-9868-A9773DA66AF9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Fish-v327-0221\\kini\\SWFToImage.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{479A1AAC-C148-40BB-9868-A9773DA66AF9}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F52B2898-3CD9-4530-8F1E-2762A2783C33}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7445F31D-8956-43AF-88B7-1C5FF7AAE1F5}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7445F31D-8956-43AF-88B7-1C5FF7AAE1F5}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{479A1AAC-C148-40BB-9868-A9773DA66AF9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F52B2898-3CD9-4530-8F1E-2762A2783C33}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F52B2898-3CD9-4530-8F1E-2762A2783C33}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SWFToImage.SWFToImageObject\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SWFToImage.SWFToImageObject\Clsid\ = "{479A1AAC-C148-40BB-9868-A9773DA66AF9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F52B2898-3CD9-4530-8F1E-2762A2783C33}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7445F31D-8956-43AF-88B7-1C5FF7AAE1F5}\ = "ISWFToImageObject"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{479A1AAC-C148-40BB-9868-A9773DA66AF9}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1988	2236	regsvr32.exe	28
PID 2236 wrote to memory of 1988	2236	regsvr32.exe	28
PID 2236 wrote to memory of 1988	2236	regsvr32.exe	28
PID 2236 wrote to memory of 1988	2236	regsvr32.exe	28
PID 2236 wrote to memory of 1988	2236	regsvr32.exe	28
PID 2236 wrote to memory of 1988	2236	regsvr32.exe	28
PID 2236 wrote to memory of 1988	2236	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Fish-v327-0221\kini\SWFToImage.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Fish-v327-0221\kini\SWFToImage.dll
  2⤵
  - Modifies registry class
  PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-0-0x0000000000AF0000-0x0000000000BA0000-memory.dmp

Filesize
704KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads