2d280b703f567beb3f4dd5d80233cd41b231826451a83157d75f93097a0c6490

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 15:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MSCAL.dll
Size

122KB
MD5

58edbcd61fcc6efb497b0ecbde37f894
SHA1

b8ba20c79a564e47576f281e2763f1c847aade05
SHA256

ed4dc592e92e36180beada15aa7b05c38bd9664522628fc25c96a4214de3b4df
SHA512

838eb1bd626e99ec5df1a09e9f2eb843b262f97805ce295255caefb7824ceb7b44c1237a237efa140d5cc1ca0122f713090c951b231a2bb4a382ea3e6182cb00
SSDEEP

3072:cH4ILP8LUaibb5Z9jHjluXHjl/AqwpimH7:cH4ILP8yHjluXx/dwB7

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E27C92D-1264-101C-8A2F-040224009C02}\ = "DCalendarEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSCAL.日历.7\CLSID\ = "{8E27C92B-1264-101C-8A2F-040224009C02}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E27C92E-1264-101C-8A2F-040224009C02}\7.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E27C92E-1264-101C-8A2F-040224009C02}\7.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E27C92C-1264-101C-8A2F-040224009C02}\ = "ICalendar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E27C92C-1264-101C-8A2F-040224009C02}\ = "ICalendar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92F-1264-101C-8A2F-040224009C02}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSCAL.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E27C92D-1264-101C-8A2F-040224009C02}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSCAL.日历	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSCAL.日历\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}\TypeLib\ = "{8E27C92E-1264-101C-8A2F-040224009C02}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E27C92E-1264-101C-8A2F-040224009C02}\7.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSCAL.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E27C92E-1264-101C-8A2F-040224009C02}\7.0\ = "Microsoft Calendar Control 11.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSCAL.日历\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSCAL.dll, 1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92F-1264-101C-8A2F-040224009C02}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E27C92C-1264-101C-8A2F-040224009C02}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E27C92D-1264-101C-8A2F-040224009C02}\TypeLib\Version = "7.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSCAL.日历.7	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E27C92C-1264-101C-8A2F-040224009C02}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E27C92C-1264-101C-8A2F-040224009C02}\TypeLib\Version = "7.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E27C92D-1264-101C-8A2F-040224009C02}\TypeLib\ = "{8E27C92E-1264-101C-8A2F-040224009C02}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSCAL.日历.7\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}\VersionIndependentProgID\ = "MSCAL.日历"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E27C92D-1264-101C-8A2F-040224009C02}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E27C92D-1264-101C-8A2F-040224009C02}\TypeLib\Version = "7.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSCAL.日历\CLSID\ = "{8E27C92B-1264-101C-8A2F-040224009C02}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSCAL.日历.7\ = "日历控件 11.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E27C92E-1264-101C-8A2F-040224009C02}\7.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E27C92C-1264-101C-8A2F-040224009C02}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E27C92C-1264-101C-8A2F-040224009C02}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSCAL.日历\ = "日历控件 11.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92F-1264-101C-8A2F-040224009C02}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E27C92E-1264-101C-8A2F-040224009C02}\7.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E27C92D-1264-101C-8A2F-040224009C02}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E27C92D-1264-101C-8A2F-040224009C02}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E27C92C-1264-101C-8A2F-040224009C02}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E27C92D-1264-101C-8A2F-040224009C02}\ = "DCalendarEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}\MiscStatus\1\ = "131473"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92F-1264-101C-8A2F-040224009C02}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSCAL.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92F-1264-101C-8A2F-040224009C02}\ = "Calendar General Propery Page Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E27C92E-1264-101C-8A2F-040224009C02}\7.0\FLAGS\ = "2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E27C92C-1264-101C-8A2F-040224009C02}\TypeLib\ = "{8E27C92E-1264-101C-8A2F-040224009C02}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E27C92D-1264-101C-8A2F-040224009C02}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E27C92D-1264-101C-8A2F-040224009C02}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSCAL.日历\CurVer\ = "MSCAL.日历.7"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}\Version\ = "7.131473"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E27C92E-1264-101C-8A2F-040224009C02}\7.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8E27C92C-1264-101C-8A2F-040224009C02}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E27C92D-1264-101C-8A2F-040224009C02}\TypeLib\ = "{8E27C92E-1264-101C-8A2F-040224009C02}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E27C92B-1264-101C-8A2F-040224009C02}	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2144	3040	regsvr32.exe	29
PID 3040 wrote to memory of 2144	3040	regsvr32.exe	29
PID 3040 wrote to memory of 2144	3040	regsvr32.exe	29
PID 3040 wrote to memory of 2144	3040	regsvr32.exe	29
PID 3040 wrote to memory of 2144	3040	regsvr32.exe	29
PID 3040 wrote to memory of 2144	3040	regsvr32.exe	29
PID 3040 wrote to memory of 2144	3040	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\MSCAL.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\MSCAL.dll
  2⤵
  - Modifies registry class
  PID:2144

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads