f07cfd6befeff9ba1e74ab66896cb288a5e1eb1fe77a59c08343d8a010d68303

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
21/06/2024, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
findcheck.dll
Size 1.4MB
Sample240621-qf3rsa1dkd
SHA256 42d9bb61fa5c3beac4bbc9961571f6e062ea9e0913df06071df2f26c4e922daa
MD5 cfb7249923e4ef0462ae28c44955ae4c
SHA1 92b21405ba8e66fa25d8d7f6ab55de8af94c865d
SHA512 cbb2581851874d56bf2b9da0e8384f15de8ed15773484d10afcd38f19091a56781c256a558b975cfb74f49d5f3a5475700154655e985a2201551ec5da4abcbf3
SSDEEP 24576:8/YApcs4yEeoBbuQrYyFJUAlYiEjSUpT+canNRnR+RIFVhO:8/hp6Bt3J/M5pYnY
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08D7FB5-70B4-4F68-8834-F367966B9B8A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08D7FB5-70B4-4F68-8834-F367966B9B8A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\findcheck.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\findcheck.one	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\findcheck.one\ = "O"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08D7FB5-70B4-4F68-8834-F367966B9B8A}\Implemented Categories\{00021494-0000-0000-C000-000000000046}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08D7FB5-70B4-4F68-8834-F367966B9B8A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08D7FB5-70B4-4F68-8834-F367966B9B8A}\ProgID\ = "findcheck.one"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08D7FB5-70B4-4F68-8834-F367966B9B8A}\ = "O"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08D7FB5-70B4-4F68-8834-F367966B9B8A}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08D7FB5-70B4-4F68-8834-F367966B9B8A}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\findcheck.one\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\findcheck.one\Clsid\ = "{F08D7FB5-70B4-4F68-8834-F367966B9B8A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08D7FB5-70B4-4F68-8834-F367966B9B8A}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08D7FB5-70B4-4F68-8834-F367966B9B8A}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4308	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 4308	892	regsvr32.exe	83
PID 892 wrote to memory of 4308	892	regsvr32.exe	83
PID 892 wrote to memory of 4308	892	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\findcheck.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\findcheck.dll
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4308

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads