2f8ef07c4298f4d295c3e30076852f4e91506fbebf95e4f3f6d156413051fe75

General

Target

2f8ef07c4298f4d295c3e30076852f4e91506fbebf95e4f3f6d156413051fe75.dll
Size

14.9MB
MD5

3b6847a057a866b4078c535886bbb697
SHA1

ef80051061371e16f0bcae4a6ac1684dc5266e8c
SHA256

2f8ef07c4298f4d295c3e30076852f4e91506fbebf95e4f3f6d156413051fe75
SHA512

a4afef6690a36999c2c5c4bdff4c5164c104214c2e85c606516aa9e86dcbb88f87f7f8b77c7f1f2c51a3f60826684d0351c90c1824f61a476de4541b6de55dfc
SSDEEP

196608:maOq1uny3VJ/e2SEdemO0u2ardbI4RN+c5pT1G6u1OPQDHWvcHiPl:mk4ny3VhnSEm0u2obI4RN+KTcQQK/9

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A7A2348-EFCF-4290-A713-DE5F847127D2}\TypeLib\ = "{2B9AC570-4405-11D2-A337-006008A9956D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{831D192D-B055-4810-8787-86950C3B064E}\TypeLib\ = "{2B9AC570-4405-11D2-A337-006008A9956D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{804442CB-9E9E-4CE3-9401-0EBB12F41188}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0AC43C36-B419-486A-B42B-54E2DB5B3688}\ = "IProfileServices"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ADAEE1D-4681-4EE7-B7F9-22B3D74D3473}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ProFile.T2\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2f8ef07c4298f4d295c3e30076852f4e91506fbebf95e4f3f6d156413051fe75.dll,1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6730C8-EDBB-4EB1-8BB0-3A8518F24CE3}\ = "IProfileGlobalOptions"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE518724-5BE3-11D2-A33A-006008A9956D}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{87ADF7E0-9456-11D3-8606-B7C0C8E9392A}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9050CC20-9856-11D3-8609-B23EF709D12C}\TypeLib\ = "{2B9AC570-4405-11D2-A337-006008A9956D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A7A2348-EFCF-4290-A713-DE5F847127D2}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E05B998-50DE-4104-B793-67983BE3F194}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{25D13261-CE2E-4F89-A930-9AC5D719EAF4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8474A37-78BE-4672-A8D5-B373ECB40537}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ABB1CDAE-33EB-4DDD-BE5B-3CA9CAF988C2}\ = "IProfileSnapShotList"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6FBCB5FA-16BC-4A86-B2A3-E7D61D61EE66}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A040085-B9F8-4A71-A3AD-90CA57DF0421}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F503016-0665-4BC3-BC16-051DE4F3B2F9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6AD6C6A0-F2E4-4631-B046-BD8582213C98}\TypeLib\ = "{2B9AC570-4405-11D2-A337-006008A9956D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A96A516B-C548-40B8-B6A6-AE14C58F97BC}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CB2508EF-67E9-4733-81CF-034592E3B251}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D1950CFE-C8A7-4CB3-BAAB-AC8758E747B9}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7F58F1F2-59D5-4F34-8EB3-D6E8BCF28607}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C74B371-E05D-4DB9-AB55-E7868A9C28E1}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9050CC20-9856-11D3-8609-B23EF709D12C}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2A7A2348-EFCF-4290-A713-DE5F847127D2}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2B9AC570-4405-11D2-A337-006008A9956D}\1.1\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE694B21-9547-11D3-8606-BB9193E3F22C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A86D9BF-CAE0-4AF9-9329-DC8AA3952B3F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA963C2E-2EA6-46CF-B152-9255F826E1D1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09B0385C-4397-428D-969D-275BA2900116}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{43FB0D00-E44C-4321-A699-463A70B7F486}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B71254EC-5829-4FFF-BBD4-AF29D65DD7DE}\ = "IProfileT1EfileService"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B5023A28-2FB3-40EC-9742-4D0A067F9798}\ = "IProfileT1EfileResponse"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE7D8DDC-64F7-4328-8B75-5EACC21C3EA4}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ProFile.T2	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6730C8-EDBB-4EB1-8BB0-3A8518F24CE3}\ = "IProfileGlobalOptions"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{264EAADC-BEE2-4A19-B3C5-BF3BA5990991}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1CFD2906-A570-4951-86E7-3382F912D1FF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6730C8-EDBB-4EB1-8BB0-3A8518F24CE3}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05973DD4-6357-4043-A2CE-E9A202C7181D}\ = "IProfileHistoryItem"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{671F78B8-8AFD-4F53-9FA1-2367088E992A}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FAA4A0E2-A436-4C64-BAD2-9A2885D8FF60}\ = "IProfileServices2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E05B998-50DE-4104-B793-67983BE3F194}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ProFile.T2.AutoSave\Shell	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{182691A0-44ED-11D2-A337-006008A9956D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9050CC20-9856-11D3-8609-B23EF709D12C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9050CC20-9856-11D3-8609-B23EF709D12C}\ = "IProfileDirectory"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FAA4A0E2-A436-4C64-BAD2-9A2885D8FF60}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D8197F1-845C-476D-A9F2-41EBB2D9D360}\TypeLib\ = "{2B9AC570-4405-11D2-A337-006008A9956D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE518725-5BE3-11D2-A33A-006008A9956D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0AC43C36-B419-486A-B42B-54E2DB5B3688}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A7A2348-EFCF-4290-A713-DE5F847127D2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{671F78B8-8AFD-4F53-9FA1-2367088E992A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{09B0385C-4397-428D-969D-275BA2900116}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D8197F1-845C-476D-A9F2-41EBB2D9D360}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B71254EC-5829-4FFF-BBD4-AF29D65DD7DE}\TypeLib\ = "{2B9AC570-4405-11D2-A337-006008A9956D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CB2508EF-67E9-4733-81CF-034592E3B251}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0AC43C36-B419-486A-B42B-54E2DB5B3688}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E05B998-50DE-4104-B793-67983BE3F194}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BA84B071-1924-41C4-BDAD-B48757F78AF6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B71254EC-5829-4FFF-BBD4-AF29D65DD7DE}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\profile.T2009T2File\ = "2009 T2 File"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA963C2E-2EA6-46CF-B152-9255F826E1D1}\TypeLib\Version = "1.1"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4688 wrote to memory of 4392	4688	regsvr32.exe	regsvr32.exe
PID 4688 wrote to memory of 4392	4688	regsvr32.exe	regsvr32.exe
PID 4688 wrote to memory of 4392	4688	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2f8ef07c4298f4d295c3e30076852f4e91506fbebf95e4f3f6d156413051fe75.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4688

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\2f8ef07c4298f4d295c3e30076852f4e91506fbebf95e4f3f6d156413051fe75.dll
2⤵
- Modifies registry class
PID:4392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4392-7-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads