b0db11cb8d232f65a27118734a477a2b3d3f0d5e8170f966ba82309cd437c114

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 11:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AVG Anti-Spyware/context.dll
Size

141KB
MD5

c9c6386cdcf2706f1bd860d63cf6405c
SHA1

847dc127ec63d290e97de81f1d7a28049115dd88
SHA256

c3f4146945bfd270946ce6701e9219bb3b0ddc4bdf3934142875977590b978c3
SHA512

1b151e73cee50f7d30483e6cdb2de0ec694a1dbd6d02dfc4461a616add710a0015802cefce4212a723f407be3abbd19f5cc50aed7fc21063b604bf3b578aa832
SSDEEP

3072:hAZ1pbtuR6y5Jz9nvzZyf6ZCwtTMvISvlisBsFUV:OnHy5lJrsiZVMHgMx

Score

1^/10

Malware Config

Signatures

Modifies registry class 33 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgas.context\ = "CContextScan Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\ = "CContextScan Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avgas.context\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\VersionIndependentProgID\ = "avgas.context"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AVG Anti-Spyware\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgas.context.1\ = "CContextScan Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgas.context\CLSID\ = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgas.context\CurVer\ = "avgas.context.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\TypeLib\ = "{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avgas.context.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avgas.context.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avgas.context\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\InprocServer32\ThreadingModel = "apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\ProgID\ = "avgas.context.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AVG Anti-Spyware\\context.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}\1.0\ = "Context 1.0 Typbibliothek"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AVG Anti-Spyware\\context.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgas.context.1\CLSID\ = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avgas.context	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8934FCEF-F5B8-468f-951F-78A921CD3920}\AppID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8416F47-1E83-44AF-8C0C-C5AB14ABDFD2}\1.0\FLAGS	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2520	2008	regsvr32.exe	28
PID 2008 wrote to memory of 2520	2008	regsvr32.exe	28
PID 2008 wrote to memory of 2520	2008	regsvr32.exe	28
PID 2008 wrote to memory of 2520	2008	regsvr32.exe	28
PID 2008 wrote to memory of 2520	2008	regsvr32.exe	28
PID 2008 wrote to memory of 2520	2008	regsvr32.exe	28
PID 2008 wrote to memory of 2520	2008	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\AVG Anti-Spyware\context.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\AVG Anti-Spyware\context.dll"
  2⤵
  - Modifies registry class
  PID:2520

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads