5ed97453be92c324567e6d0baf4bc7d001b5925e71ad957e495463893ed1af1d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$SYSDIR/AlphaDIB.dll
Size

740KB
MD5

08f61aa236190c5ae82ac2025312fc67
SHA1

17561c1bc8526a14e19168ac2e72000874250e40
SHA256

45d06642016f4037ae707a1ed07546cdfa679ab96b9bb2c808b8c846334a7a88
SHA512

057ab52f42c2678cd4597cbd1df39e43809c00420a0086a11d812cf7e7e0f85feb75fe818cf7ce5f70a518589200caa4e2b27b41cb9c8de3ba418e468328c85f
SSDEEP

12288:Wgkq1G4jM9zwvWIIDeV5VGRDSZvWH5O67EMI/zXy/Xwu/sro3X5AzTtTnB:Wgv1DjMJwvWIIK5VwWZviO67EMI/zXy

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C02F02E3-3B0B-4944-86AC-0F72330D59E6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F08AB694-7C14-4056-A542-67A6477DD2E8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.IOwnerDrawButton\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F08AB694-7C14-4056-A542-67A6477DD2E8}\ = "cOwnerDrawButton"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.cDIBSection\Clsid\ = "{EA8553CE-E4A9-4132-A316-EA24DEBFB7CA}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{060F4642-855F-4380-92CC-05B2EF76CABB}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\AlphaDIB.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{22005FBF-3C18-4CBF-B473-3E27C1643E9A}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76F4D4AA-16B2-48C3-877A-3658E914B6B8}\TypeLib\ = "{8392AEE0-DA0B-40F7-A296-C4C5A6937B28}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DC057A5F-F246-4A1A-8B60-8A4ACF6E3818}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.cRegistry\Clsid\ = "{33A22CD6-1E78-46E4-B146-F3D95573384B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2673643C-7824-41E7-9A9F-D487C4DE4160}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F90FA753-BAEF-4A73-83FA-C90CE796D419}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3C3DD011-1058-41BB-A8D8-E9D1D160D85C}\TypeLib\ = "{8392AEE0-DA0B-40F7-A296-C4C5A6937B28}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C02F02E3-3B0B-4944-86AC-0F72330D59E6}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DC057A5F-F246-4A1A-8B60-8A4ACF6E3818}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6ADCDAC6-5B49-4294-9868-BEFFBAACE1AD}\VERSION\ = "7.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.cSplitter\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F2996E1-BB8B-46A9-B72A-B14CEA21A806}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E15FE4C0-8EA1-4CE7-8309-38F29595D0D5}\ = "_cDIBSectionSave"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C86D8DB9-097A-488A-8761-EC4B2EF3F589}\TypeLib\Version = "7.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2BAFF457-D4A7-4C68-B96B-AE0DD37E4BF6}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.cOwnerDrawButton\Clsid\ = "{0EB64583-9422-4C0B-BC3A-A3B00497112D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{17E7CFDF-240E-4B01-BB78-5CFD895B4467}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F2996E1-BB8B-46A9-B72A-B14CEA21A806}\TypeLib\ = "{8392AEE0-DA0B-40F7-A296-C4C5A6937B28}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33A22CD6-1E78-46E4-B146-F3D95573384B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\AlphaDIB.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FCB69DC-57E4-46DB-805F-E3E747F6D012}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E924BB86-2696-4039-A5D0-FFC63CF23C83}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DB6D2F18-6677-4646-8FE4-2361805CA252}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.clsAccelerator\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.cWindowsHook\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33A22CD6-1E78-46E4-B146-F3D95573384B}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F589A524-BD2A-4796-8039-F3087AFDF19C}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7DF1A90-7546-41BE-B0F9-4F26A7DA6D8A}\ = "_cDIBSection256"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8226B2F0-D473-4C5E-94C1-5E5C4B6ED512}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8226B2F0-D473-4C5E-94C1-5E5C4B6ED512}\TypeLib\ = "{8392AEE0-DA0B-40F7-A296-C4C5A6937B28}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{52A27DE3-C1F1-4E4E-A6AC-1051C48C4822}\ = "_cScrollBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8A7D3BAC-0D9C-4294-AEFC-024C33442A04}\TypeLib\ = "{8392AEE0-DA0B-40F7-A296-C4C5A6937B28}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2931F8C6-2AA0-4150-A984-E77207DD6649}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3C3DD011-1058-41BB-A8D8-E9D1D160D85C}\ = "256 Colors Dib Section Palette Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B6FD63FF-9A04-405B-B8E5-9E265C6C60A0}\ = "_cGradientFill"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EEE04923-F414-4EF1-9E42-949F71C8B347}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAEACA6B-7EF9-4256-8B0A-28DB58C0CE0A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3582C51-3121-4E10-B7DC-EDFD4D8F21AE}\TypeLib\ = "{8392AEE0-DA0B-40F7-A296-C4C5A6937B28}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DFEC2C61-6343-416F-80DD-DC3B2E8B3117}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{619D367B-5E1C-4146-8D76-A183336FEC66}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{047FF39C-80C9-4F5E-800D-635EF4C63A36}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.clsString	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{22005FBF-3C18-4CBF-B473-3E27C1643E9A}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F90FA753-BAEF-4A73-83FA-C90CE796D419}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EA8553CE-E4A9-4132-A316-EA24DEBFB7CA}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.cPalette\Clsid\ = "{3C3DD011-1058-41BB-A8D8-E9D1D160D85C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8226B2F0-D473-4C5E-94C1-5E5C4B6ED512}\ = "cPalette"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DF177B1D-80F6-4FFA-B8B5-4A915977FB36}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C7BD216-F558-41B3-B16A-34C832DB214C}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAEACA6B-7EF9-4256-8B0A-28DB58C0CE0A}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{77D32DB4-F032-4C17-A4D4-02379214F723}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7833E9D1-FC56-45D6-B76D-8EBBDE077F82}\ProgID\ = "AlphaDIB.cBitmap"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3C3DD011-1058-41BB-A8D8-E9D1D160D85C}\VERSION\ = "7.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34BDA848-2C36-40C4-8076-6AC28F2A3297}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F244642D-E67F-4D61-886A-8E58594E90DB}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F2785BCD-069F-481D-85ED-13C0BC18E4A5}\TypeLib\Version = "7.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0EB64583-9422-4C0B-BC3A-A3B00497112D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F244642D-E67F-4D61-886A-8E58594E90DB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0EB64583-9422-4C0B-BC3A-A3B00497112D}\Programmable	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2680	2032	regsvr32.exe	28
PID 2032 wrote to memory of 2680	2032	regsvr32.exe	28
PID 2032 wrote to memory of 2680	2032	regsvr32.exe	28
PID 2032 wrote to memory of 2680	2032	regsvr32.exe	28
PID 2032 wrote to memory of 2680	2032	regsvr32.exe	28
PID 2032 wrote to memory of 2680	2032	regsvr32.exe	28
PID 2032 wrote to memory of 2680	2032	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\AlphaDIB.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\AlphaDIB.dll
  2⤵
  - Modifies registry class
  PID:2680

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads