f686f33c05d63eb019164da669495fbb53c181d4d39603d03018afd883a923e9

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dll/web2pic_url.dll
Size

67KB
MD5

0fe9b04cef9e12ff42a98063e5eaf88e
SHA1

ce94fccbe029321bcb98d0fbd046b77d181d653f
SHA256

6ce48ee16d00619ae509db03a41e60ceacfc6f279ba0ee5e4da2a0e1df898959
SHA512

b0b864cbdfe55457005a7dbb316a7770ab1831cb977d08550a8f7c3bbb3dea69fc5f732438bcfb7b28c938ed019458dc14cbf95f8eba7460accb691640811ca8
SSDEEP

1536:eZWmdOAnbfWkmUcpkuRjYvURhZ1rpz7q6KqqR6VG5Pq:e4m44rh/TvUXft5h

Score

1^/10

Malware Config

Signatures

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HtmlPictureManager.CatchPicUrl\Clsid\ = "{BB366341-1682-4F2D-833C-C281B6C924D8}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Dll\\web2pic_url.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\TypeLib\ = "{78BB0398-573C-4F8C-BD27-B57A41A17E19}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HtmlPictureManager.CatchPicUrl\ = "CatchPicUrl Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\ = "ICatchPicUrl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\ = "CatchPicUrl Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HtmlPictureManager.CatchPicUrl	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Dll\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Dll\\web2pic_url.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}\1.0\ = "HtmlPictureManager Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\TypeLib\ = "{78BB0398-573C-4F8C-BD27-B57A41A17E19}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HtmlPictureManager.CatchPicUrl\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\TypeLib\ = "{78BB0398-573C-4F8C-BD27-B57A41A17E19}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\ProgID\ = "HtmlPictureManager.CatchPicUrl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78BB0398-573C-4F8C-BD27-B57A41A17E19}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\ = "ICatchPicUrl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55A8850D-4467-4AC2-8696-4B87330690C7}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BB366341-1682-4F2D-833C-C281B6C924D8}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 916	2820	regsvr32.exe	82
PID 2820 wrote to memory of 916	2820	regsvr32.exe	82
PID 2820 wrote to memory of 916	2820	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Dll\web2pic_url.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Dll\web2pic_url.dll
  2⤵
  - Modifies registry class
  PID:916

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads