88eb59a5c1ba1ddbdca3fc449999e6679d6da43ce3e2dbd32df822fbb447e553

Analysis

max time kernel
125s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88eb59a5c1ba1ddbdca3fc449999e6679d6da43ce3e2dbd32df822fbb447e553.dll
Size

2.4MB
MD5

ae8b032ec75b68f77072f34c0bf9b1fb
SHA1

f40fc20219c4780a575a83fb1298c6f088dc6dd0
SHA256

88eb59a5c1ba1ddbdca3fc449999e6679d6da43ce3e2dbd32df822fbb447e553
SHA512

cda8de013989e3ae96ea35b53c9cd16fc417bf8d33209e18e90a4309e5661c8170d06d6ec650ffd897f1f37775e90d18c1ef98249ac8cfdec085c74b87192938
SSDEEP

49152:hoo+zQ6KWnfaZTcDU7TVMj9kx1pqighV0XW:hAQ6KB1Mj9kx1x

Score

1^/10

Malware Config

Signatures

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\ProgID\ = "OL2003Addin.Addin.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\ = "IAddin"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin.1\CLSID\ = "{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin\ = "Addin Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\88eb59a5c1ba1ddbdca3fc449999e6679d6da43ce3e2dbd32df822fbb447e553.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\TypeLib\ = "{EC7B995D-7EFE-412A-8D3A-B3810BB97821}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin.1\ = "Addin Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin\CurVer\ = "OL2003Addin.Addin.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\TypeLib\ = "{EC7B995D-7EFE-412A-8D3A-B3810BB97821}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\VersionIndependentProgID\ = "OL2003Addin.Addin"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\TypeLib\ = "{EC7B995D-7EFE-412A-8D3A-B3810BB97821}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\ = "OL2003Addin 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin\CLSID\ = "{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\ = "IAddin"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\88eb59a5c1ba1ddbdca3fc449999e6679d6da43ce3e2dbd32df822fbb447e553.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\ = "Addin Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 2988	3696	regsvr32.exe	88
PID 3696 wrote to memory of 2988	3696	regsvr32.exe	88
PID 3696 wrote to memory of 2988	3696	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\88eb59a5c1ba1ddbdca3fc449999e6679d6da43ce3e2dbd32df822fbb447e553.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\88eb59a5c1ba1ddbdca3fc449999e6679d6da43ce3e2dbd32df822fbb447e553.dll
  2⤵
  - Modifies registry class
  PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3756,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
1⤵
PID:4976

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads