577a7ec9e58665b9b840ce9618e2d330c065dc9a7d7b2109f52e392b77e839c4

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 03:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efsbar.dll
Size

149KB
MD5

26eccc32791911ccdfe0aec05f733cf8
SHA1

cf0ffd6ee73c6dcb7cd52f4a863b6a5e44c29cbd
SHA256

b4f5d03f1649f2631e122dba48a18e3ee705d073ce5800bda90730d0ad6a35c1
SHA512

6841d08827476416bdc8ee2a224c0f2aaa8827acc32a78e1ecd3fecd796fadc2fc4aaf78af11f9e14a6ffcbc70bf7205c482f34a36ec07d3cc412d45d62cdf35
SSDEEP

1536:Wr4H2HeDqt8Q7h3fKHiJdbYBsPV30tgyFicvjRvNLMzuH8UkUYjSzgUSYez2eJIy:WfHe68G3mOZxV3WgSZFCzuHMxrUnu

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8A3508D-B8F0-4619-94D1-A85A54B9ABAE}\ = "CHandler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{22FD679B-DCE6-4B67-BC7A-EBE8326D40DB}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A294C45-07CC-426C-9512-6742053E462C}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D815AB8A-E840-4054-B37D-943893116452}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D815AB8A-E840-4054-B37D-943893116452}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A294C45-07CC-426C-9512-6742053E462C}\ = "efindersidebar.CSideBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A294C45-07CC-426C-9512-6742053E462C}\ProgID\ = "efindersidebar.CSideBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A294C45-07CC-426C-9512-6742053E462C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A294C45-07CC-426C-9512-6742053E462C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{22FD679B-DCE6-4B67-BC7A-EBE8326D40DB}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\efsbar.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{22FD679B-DCE6-4B67-BC7A-EBE8326D40DB}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}\ = "_CSideBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D815AB8A-E840-4054-B37D-943893116452}\VERSION\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\efindersidebar.CHandler	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D815AB8A-E840-4054-B37D-943893116452}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{22FD679B-DCE6-4B67-BC7A-EBE8326D40DB}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8A3508D-B8F0-4619-94D1-A85A54B9ABAE}\TypeLib\ = "{22FD679B-DCE6-4B67-BC7A-EBE8326D40DB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A294C45-07CC-426C-9512-6742053E462C}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8A3508D-B8F0-4619-94D1-A85A54B9ABAE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A294C45-07CC-426C-9512-6742053E462C}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D815AB8A-E840-4054-B37D-943893116452}\ = "efindersidebar.CHandler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8A3508D-B8F0-4619-94D1-A85A54B9ABAE}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}\ = "CSideBar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A294C45-07CC-426C-9512-6742053E462C}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8A3508D-B8F0-4619-94D1-A85A54B9ABAE}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8A3508D-B8F0-4619-94D1-A85A54B9ABAE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}\TypeLib\ = "{22FD679B-DCE6-4B67-BC7A-EBE8326D40DB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{22FD679B-DCE6-4B67-BC7A-EBE8326D40DB}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\efindersidebar.CSideBar\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\efindersidebar.CHandler\Clsid\ = "{D815AB8A-E840-4054-B37D-943893116452}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D815AB8A-E840-4054-B37D-943893116452}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}\TypeLib\ = "{22FD679B-DCE6-4B67-BC7A-EBE8326D40DB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A294C45-07CC-426C-9512-6742053E462C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A294C45-07CC-426C-9512-6742053E462C}\TypeLib\ = "{22FD679B-DCE6-4B67-BC7A-EBE8326D40DB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\efindersidebar.CSideBar	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\efindersidebar.CSideBar\ = "efindersidebar.CSideBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{22FD679B-DCE6-4B67-BC7A-EBE8326D40DB}\1.0\ = "efindersidebar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8A3508D-B8F0-4619-94D1-A85A54B9ABAE}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8A3508D-B8F0-4619-94D1-A85A54B9ABAE}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}\ = "_CSideBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D815AB8A-E840-4054-B37D-943893116452}\ProgID\ = "efindersidebar.CHandler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8A3508D-B8F0-4619-94D1-A85A54B9ABAE}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D815AB8A-E840-4054-B37D-943893116452}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\efsbar.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\efindersidebar.CHandler\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BEA1FA35-AC92-4978-8556-0AFCD9B52FA2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{22FD679B-DCE6-4B67-BC7A-EBE8326D40DB}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8A3508D-B8F0-4619-94D1-A85A54B9ABAE}\ = "_CHandler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8A3508D-B8F0-4619-94D1-A85A54B9ABAE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8A3508D-B8F0-4619-94D1-A85A54B9ABAE}\ = "_CHandler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D815AB8A-E840-4054-B37D-943893116452}\TypeLib\ = "{22FD679B-DCE6-4B67-BC7A-EBE8326D40DB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{22FD679B-DCE6-4B67-BC7A-EBE8326D40DB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8A3508D-B8F0-4619-94D1-A85A54B9ABAE}\TypeLib\ = "{22FD679B-DCE6-4B67-BC7A-EBE8326D40DB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A294C45-07CC-426C-9512-6742053E462C}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D815AB8A-E840-4054-B37D-943893116452}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 4588	2916	regsvr32.exe	82
PID 2916 wrote to memory of 4588	2916	regsvr32.exe	82
PID 2916 wrote to memory of 4588	2916	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\efsbar.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\efsbar.dll
  2⤵
  - Modifies registry class
  PID:4588

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads