43920a20626a75e1da4f04d7cfb399480555200543a1205615cd18e37ea188d1

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QQLive/ADManage.dll
Size

377KB
MD5

e160db02655e6a8ce714448afe9ed46a
SHA1

46762effdff70a5d346720d0acd69b0b59360641
SHA256

23a6b70d2a7c43a37f45e4269db231af18dc69f7a025bbf28f5971b9586c5d8a
SHA512

e9feddbe6a44f64ff34f9cc15619b1978337862dedb160f2feea299d50210879d7c1d4cd9e8a0515462b94e9ddc7935f505377572c01dde0c55920aec92c0531
SSDEEP

6144:Y4ojoZ9mOnICMkUUjeLp3CBw+ebJTBqvkvNOAbnNih:/oo9mOnITUjeJCBw+ebJTsv+ih

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C37D0C6D-6F0C-4A82-B9AE-F3D224BFDCED}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76E90C80-0E56-4AC8-8E60-984DA4CE5A1E}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19E61346-57A0-4D9A-9098-45CA3ACE17D0}\ = "_IQQLiveADEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19E61346-57A0-4D9A-9098-45CA3ACE17D0}\TypeLib\ = "{76E90C80-0E56-4AC8-8E60-984DA4CE5A1E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DBD4604C-C0C3-466B-8E50-2D8E71F0A837}\ProxyStubClsid32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ADManage.LDADPlay.1	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ADManage.DLL	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ADManage.ADDownload\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ADManage.ADDownload\CurVer\ = "ADManage.ADDownload.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8EFC298E-312C-4A4A-8DD6-4303CA8D26BB}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QQLive\\ADManage.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ADManage.LDADPlay\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C37D0C6D-6F0C-4A82-B9AE-F3D224BFDCED}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76E90C80-0E56-4AC8-8E60-984DA4CE5A1E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ADManage.ADDownload.1\CLSID\ = "{8EFC298E-312C-4A4A-8DD6-4303CA8D26BB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ADManage.LDADPlay.1\CLSID\ = "{C37D0C6D-6F0C-4A82-B9AE-F3D224BFDCED}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2BA125D-D669-4F85-92D6-19F8F64406ED}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B25F3F06-6FB9-4956-9678-3F9A5F76D485}\ = "ILDADPlay"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B25F3F06-6FB9-4956-9678-3F9A5F76D485}\ProxyStubClsid32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ADManage.ADDownload\CurVer	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C37D0C6D-6F0C-4A82-B9AE-F3D224BFDCED}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ADManage.LDADPlay.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{87D3B02A-6BF2-4ABE-BFD2-426F297DB13B}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2BA125D-D669-4F85-92D6-19F8F64406ED}\VersionIndependentProgID\ = "ADManage.QQLiveAD"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B25F3F06-6FB9-4956-9678-3F9A5F76D485}\ = "ILDADPlay"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ADManage.ADDownload.1	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ADManage.QQLiveAD\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C37D0C6D-6F0C-4A82-B9AE-F3D224BFDCED}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C37D0C6D-6F0C-4A82-B9AE-F3D224BFDCED}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2BA125D-D669-4F85-92D6-19F8F64406ED}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76E90C80-0E56-4AC8-8E60-984DA4CE5A1E}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76E90C80-0E56-4AC8-8E60-984DA4CE5A1E}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76E90C80-0E56-4AC8-8E60-984DA4CE5A1E}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QQLive\\ADManage.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19E61346-57A0-4D9A-9098-45CA3ACE17D0}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{87D3B02A-6BF2-4ABE-BFD2-426F297DB13B}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8EFC298E-312C-4A4A-8DD6-4303CA8D26BB}\ = "ADDownload Class"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8EFC298E-312C-4A4A-8DD6-4303CA8D26BB}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2BA125D-D669-4F85-92D6-19F8F64406ED}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B25F3F06-6FB9-4956-9678-3F9A5F76D485}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ADManage.ADDownload\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8EFC298E-312C-4A4A-8DD6-4303CA8D26BB}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ADManage.LDADPlay.1\ = "LDADPlay Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{87D3B02A-6BF2-4ABE-BFD2-426F297DB13B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ADManage.LDADPlay\ = "LDADPlay Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2BA125D-D669-4F85-92D6-19F8F64406ED}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{76E90C80-0E56-4AC8-8E60-984DA4CE5A1E}\1.0\HELPDIR\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{87D3B02A-6BF2-4ABE-BFD2-426F297DB13B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DBD4604C-C0C3-466B-8E50-2D8E71F0A837}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DBD4604C-C0C3-466B-8E50-2D8E71F0A837}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8EFC298E-312C-4A4A-8DD6-4303CA8D26BB}\TypeLib\ = "{BBD0EAB1-DD48-4213-A302-993C4EEB360A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19E61346-57A0-4D9A-9098-45CA3ACE17D0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B25F3F06-6FB9-4956-9678-3F9A5F76D485}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8EFC298E-312C-4A4A-8DD6-4303CA8D26BB}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2BA125D-D669-4F85-92D6-19F8F64406ED}\ProgID\ = "ADManage.QQLiveAD.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19E61346-57A0-4D9A-9098-45CA3ACE17D0}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{87D3B02A-6BF2-4ABE-BFD2-426F297DB13B}\TypeLib\Version = "1.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8EFC298E-312C-4A4A-8DD6-4303CA8D26BB}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C37D0C6D-6F0C-4A82-B9AE-F3D224BFDCED}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C37D0C6D-6F0C-4A82-B9AE-F3D224BFDCED}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ADManage.LDADPlay\CLSID\ = "{C37D0C6D-6F0C-4A82-B9AE-F3D224BFDCED}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ADManage.QQLiveAD\CurVer\ = "ADManage.QQLiveAD.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DBD4604C-C0C3-466B-8E50-2D8E71F0A837}\ = "IADDownload"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ADManage.ADDownload	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8EFC298E-312C-4A4A-8DD6-4303CA8D26BB}\VersionIndependentProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2BA125D-D669-4F85-92D6-19F8F64406ED}\Programmable	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 3420	4676	regsvr32.exe	85
PID 4676 wrote to memory of 3420	4676	regsvr32.exe	85
PID 4676 wrote to memory of 3420	4676	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\QQLive\ADManage.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\QQLive\ADManage.dll
  2⤵
  - Modifies registry class
  PID:3420

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads