5ed97453be92c324567e6d0baf4bc7d001b5925e71ad957e495463893ed1af1d

Analysis

max time kernel
135s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$SYSDIR/AlphaDIB.dll
Size

740KB
MD5

08f61aa236190c5ae82ac2025312fc67
SHA1

17561c1bc8526a14e19168ac2e72000874250e40
SHA256

45d06642016f4037ae707a1ed07546cdfa679ab96b9bb2c808b8c846334a7a88
SHA512

057ab52f42c2678cd4597cbd1df39e43809c00420a0086a11d812cf7e7e0f85feb75fe818cf7ce5f70a518589200caa4e2b27b41cb9c8de3ba418e468328c85f
SSDEEP

12288:Wgkq1G4jM9zwvWIIDeV5VGRDSZvWH5O67EMI/zXy/Xwu/sro3X5AzTtTnB:Wgv1DjMJwvWIIK5VwWZviO67EMI/zXy

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C7BD216-F558-41B3-B16A-34C832DB214C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DFEC2C61-6343-416F-80DD-DC3B2E8B3117}\TypeLib\Version = "7.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B38434C2-277B-425E-8F76-928FF6FC5111}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DC057A5F-F246-4A1A-8B60-8A4ACF6E3818}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1C0EB050-0C9B-4463-9E0E-4E2B640F1B39}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{060F4642-855F-4380-92CC-05B2EF76CABB}\VERSION\ = "7.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7262EB07-AF04-4D8F-9966-05ED6E36C657}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E063117A-4B4B-481C-A22C-8B2FDB2D1A53}\ = "_cActiveTitleBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF177B1D-80F6-4FFA-B8B5-4A915977FB36}\TypeLib\Version = "7.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34BDA848-2C36-40C4-8076-6AC28F2A3297}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B529BA3-A659-4B2C-9A8F-8980F102886C}\ = "_ISubclass6"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.clsPen\ = "AlphaDIB.clsPen"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A27BF6D1-5AC9-4CA7-B88F-C2139841E7A5}\ProgID\ = "AlphaDIB.clsString"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F90FA753-BAEF-4A73-83FA-C90CE796D419}\VERSION\ = "7.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{060F4642-855F-4380-92CC-05B2EF76CABB}\ = "Dib Section Image Processing Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AC130FB0-7B69-4097-9C98-4BB437AB62BC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.clsFunctions\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F2785BCD-069F-481D-85ED-13C0BC18E4A5}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FCB69DC-57E4-46DB-805F-E3E747F6D012}\ = "cDIBShadowCreator"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{932A6F7A-E710-4BF1-B469-AB5B5F61474D}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{619D367B-5E1C-4146-8D76-A183336FEC66}\ = "_cImageProcessDIB"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17E7CFDF-240E-4B01-BB78-5CFD895B4467}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A27BF6D1-5AC9-4CA7-B88F-C2139841E7A5}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.cSplitter	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{060F4642-855F-4380-92CC-05B2EF76CABB}\ProgID\ = "AlphaDIB.cImageProcessDIB"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BBC1C59-FF64-4D6A-9057-D35944A6BEA4}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AC130FB0-7B69-4097-9C98-4BB437AB62BC}\ = "_cAlphaDibSection"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{52A27DE3-C1F1-4E4E-A6AC-1051C48C4822}\ = "_cScrollBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EB64583-9422-4C0B-BC3A-A3B00497112D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DF177B1D-80F6-4FFA-B8B5-4A915977FB36}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF7ACF58-43D8-4B0D-B198-77E884F2B3DD}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{956DAB7F-EBDB-4296-A1D1-5DF320DF4E30}\ = "clsRgn"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B529BA3-A659-4B2C-9A8F-8980F102886C}\TypeLib\Version = "7.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.cBitmap\ = "Bitmap Cache Class(Not Stable)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{52A27DE3-C1F1-4E4E-A6AC-1051C48C4822}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2BAFF457-D4A7-4C68-B96B-AE0DD37E4BF6}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E30E45DE-14C3-4C39-8BFF-D97A2F6BB60B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAEACA6B-7EF9-4256-8B0A-28DB58C0CE0A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EB64583-9422-4C0B-BC3A-A3B00497112D}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8D55DC8B-8548-4CCD-8B18-ECE82415FD53}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FC0F04F3-8681-4F38-A647-251F2DB40CC4}\ProgID\ = "AlphaDIB.cAlphaDibSection"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FC0F04F3-8681-4F38-A647-251F2DB40CC4}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2BAFF457-D4A7-4C68-B96B-AE0DD37E4BF6}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F08AB694-7C14-4056-A542-67A6477DD2E8}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{938AB9FB-2726-4636-B373-042EE0A0F861}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B38434C2-277B-425E-8F76-928FF6FC5111}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{077843BD-79F8-435B-8065-FA96B69499CD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAEACA6B-7EF9-4256-8B0A-28DB58C0CE0A}\TypeLib\ = "{8392AEE0-DA0B-40F7-A296-C4C5A6937B28}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FBD0810B-66C1-4CDD-B04B-CFB636A3B8E7}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F2996E1-BB8B-46A9-B72A-B14CEA21A806}\VERSION	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{043BC44E-D64A-43C4-A451-679829CB88E0}\VERSION	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7833E9D1-FC56-45D6-B76D-8EBBDE077F82}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\AlphaDIB.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D958ECAE-0410-462B-BF2D-0FAB473F32CE}\TypeLib\Version = "7.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{938AB9FB-2726-4636-B373-042EE0A0F861}\ = "_clsPen"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{52A27DE3-C1F1-4E4E-A6AC-1051C48C4822}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7574C28F-5BFC-43AC-A89E-370C9366F6A4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\AlphaDIB.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{22005FBF-3C18-4CBF-B473-3E27C1643E9A}\TypeLib\Version = "7.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C0EB050-0C9B-4463-9E0E-4E2B640F1B39}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B3F1B5E-7307-43CE-97FB-3B3469D6A202}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB6D2F18-6677-4646-8FE4-2361805CA252}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F2785BCD-069F-481D-85ED-13C0BC18E4A5}\ = "__cImageProcessDIB"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.cActiveTitleBar\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.cActiveTitleBar\Clsid\ = "{E924BB86-2696-4039-A5D0-FFC63CF23C83}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB6D2F18-6677-4646-8FE4-2361805CA252}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2116	1656	regsvr32.exe	92
PID 1656 wrote to memory of 2116	1656	regsvr32.exe	92
PID 1656 wrote to memory of 2116	1656	regsvr32.exe	92

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\AlphaDIB.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\AlphaDIB.dll
  2⤵
  - Modifies registry class
  PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4524,i,8447163055677043976,7218082390179600880,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:8
1⤵
PID:2108

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads