265c863c1cda7c59859a7e222b30dbadfa2728f0211269ac6f38636e4c486992

Analysis

max time kernel
11s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$SYSDIR/cdxareader.dll
Size

248KB
MD5

ad7626525fcd82da4608aa2813134188
SHA1

f74809b1780de796b9c4e98096d0995c4758c972
SHA256

000c5e8238c076deef3bd091a8c83af247a2a24ef59252590f04d946804c9471
SHA512

32f559b8db5188a989e02031ddaa3ee021b31b8f44ae824697302871ca01cab63ae60696bf3d155a6400d2999ab49a49fccbe0eca9b8fed0382e44460d1f8f92
SSDEEP

3072:S35taHwOIkwemfgT3oD44OrKagBGA3PxSoUI4wr73W5UAtMLioEM2y2KO+1:9Ce/3oD4vrKNqo0+LioEfyi

Score

1^/10

Malware Config

Signatures

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D367878E-F3B8-4235-A968-F378EF1B9A44}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D367878E-F3B8-4235-A968-F378EF1B9A44}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\cdxareader.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D367878E-F3B8-4235-A968-F378EF1B9A44}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D367878E-F3B8-4235-A968-F378EF1B9A44}\CLSID = "{D367878E-F3B8-4235-A968-F378EF1B9A44}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{D367878E-F3B8-4235-A968-F378EF1B9A44}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D367878E-F3B8-4235-A968-F378EF1B9A44}\ = "CDXA Reader"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D367878E-F3B8-4235-A968-F378EF1B9A44}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D367878E-F3B8-4235-A968-F378EF1B9A44}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D367878E-F3B8-4235-A968-F378EF1B9A44}\FriendlyName = "CDXA Reader"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D367878E-F3B8-4235-A968-F378EF1B9A44}\FilterData = 020000000000400001000000000000003070693308000000000000000100000000000000000000003074793300000000380000004800000083eb36e44f52ce119f530020af0ba77000000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{D367878E-F3B8-4235-A968-F378EF1B9A44}\0 = "0,4,,52494646,8,4,,43445841"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{D367878E-F3B8-4235-A968-F378EF1B9A44}\Source Filter = "{D367878E-F3B8-4235-A968-F378EF1B9A44}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 1696	2304	regsvr32.exe	29
PID 2304 wrote to memory of 1696	2304	regsvr32.exe	29
PID 2304 wrote to memory of 1696	2304	regsvr32.exe	29
PID 2304 wrote to memory of 1696	2304	regsvr32.exe	29
PID 2304 wrote to memory of 1696	2304	regsvr32.exe	29
PID 2304 wrote to memory of 1696	2304	regsvr32.exe	29
PID 2304 wrote to memory of 1696	2304	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\cdxareader.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\cdxareader.dll
  2⤵
  - Modifies registry class
  PID:1696

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads