1f2405740435571205a1a46fb269655fd16c471c339e9955497d9d4269f384b7

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 03:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AddIn/VisLrc.dll
Size

6KB
MD5

b471b27322f7d2568bfc65f10725a350
SHA1

99866e16c7f455bf0e66c9340217582252a7fee4
SHA256

232a33c18e239288c4ff48020403ab29b6063fff635b7e7ee970c669af489add
SHA512

68e0cd573ca3928f98ff052d8b56f8c78bd8da2b8eb8ecb1dc77777219f023bedaf698625c8ece5971ca1dcdfb826c8cbcbb4261c5ea817ed7bcad40e2012992
SSDEEP

96:RiiRItRxdjmL2wgCczG9cocKcdRC7z4IAILD2KEjAsIA:DRMRxILuy9cocKcdRC7z4IIZIA

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral9/memory/2640-0-0x0000000011000000-0x0000000011008000-memory.dmp	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral9/memory/2640-0-0x0000000011000000-0x0000000011008000-memory.dmp	upx

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{F79BA911-11F5-4AEF-A3EE-BD3E1EA41961}\1.0\ = "¹¤³Ì1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0FDA612F-EAA3-4130-8379-786FCF0134DD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0FDA612F-EAA3-4130-8379-786FCF0134DD}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{F79BA911-11F5-4AEF-A3EE-BD3E1EA41961}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D18E70C2-F3DD-4ED1-85CF-57B0DFE1CAF3}\ = "__UserControl1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D18E70C2-F3DD-4ED1-85CF-57B0DFE1CAF3}\TypeLib\ = "{F79BA911-11F5-4AEF-A3EE-BD3E1EA41961}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D18E70C2-F3DD-4ED1-85CF-57B0DFE1CAF3}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\TypeLib\ = "{F79BA911-11F5-4AEF-A3EE-BD3E1EA41961}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\VERSION	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\VERSION\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0FDA612F-EAA3-4130-8379-786FCF0134DD}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0FDA612F-EAA3-4130-8379-786FCF0134DD}\TypeLib\ = "{F79BA911-11F5-4AEF-A3EE-BD3E1EA41961}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D18E70C2-F3DD-4ED1-85CF-57B0DFE1CAF3}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\¹¤³Ì1.UserControl1\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0FDA612F-EAA3-4130-8379-786FCF0134DD}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{F79BA911-11F5-4AEF-A3EE-BD3E1EA41961}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{F79BA911-11F5-4AEF-A3EE-BD3E1EA41961}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D18E70C2-F3DD-4ED1-85CF-57B0DFE1CAF3}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\ = "¹¤³Ì1.UserControl1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0FDA612F-EAA3-4130-8379-786FCF0134DD}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0FDA612F-EAA3-4130-8379-786FCF0134DD}\TypeLib\ = "{F79BA911-11F5-4AEF-A3EE-BD3E1EA41961}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D18E70C2-F3DD-4ED1-85CF-57B0DFE1CAF3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\ProgID\ = "¹¤³Ì1.UserControl1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0FDA612F-EAA3-4130-8379-786FCF0134DD}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0FDA612F-EAA3-4130-8379-786FCF0134DD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D18E70C2-F3DD-4ED1-85CF-57B0DFE1CAF3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D18E70C2-F3DD-4ED1-85CF-57B0DFE1CAF3}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0FDA612F-EAA3-4130-8379-786FCF0134DD}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D18E70C2-F3DD-4ED1-85CF-57B0DFE1CAF3}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D18E70C2-F3DD-4ED1-85CF-57B0DFE1CAF3}\TypeLib\ = "{F79BA911-11F5-4AEF-A3EE-BD3E1EA41961}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{F79BA911-11F5-4AEF-A3EE-BD3E1EA41961}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AddIn\\VisLrc.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0FDA612F-EAA3-4130-8379-786FCF0134DD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0FDA612F-EAA3-4130-8379-786FCF0134DD}\ = "_UserControl1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\¹¤³Ì1.UserControl1\ = "¹¤³Ì1.UserControl1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D18E70C2-F3DD-4ED1-85CF-57B0DFE1CAF3}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D18E70C2-F3DD-4ED1-85CF-57B0DFE1CAF3}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\¹¤³Ì1.UserControl1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0FDA612F-EAA3-4130-8379-786FCF0134DD}\ = "UserControl1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0FDA612F-EAA3-4130-8379-786FCF0134DD}\ = "_UserControl1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D18E70C2-F3DD-4ED1-85CF-57B0DFE1CAF3}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\Control\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{F79BA911-11F5-4AEF-A3EE-BD3E1EA41961}\1.0\FLAGS\ = "2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0FDA612F-EAA3-4130-8379-786FCF0134DD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0FDA612F-EAA3-4130-8379-786FCF0134DD}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0FDA612F-EAA3-4130-8379-786FCF0134DD}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AddIn\\VisLrc.dll, 30000"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\MiscStatus\1\ = "131473"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{F79BA911-11F5-4AEF-A3EE-BD3E1EA41961}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D18E70C2-F3DD-4ED1-85CF-57B0DFE1CAF3}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D18E70C2-F3DD-4ED1-85CF-57B0DFE1CAF3}\ = "__UserControl1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AddIn\\VisLrc.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{45E1C090-DEB8-450B-BB53-814F6559281D}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{F79BA911-11F5-4AEF-A3EE-BD3E1EA41961}\1.0\0	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2640	3020	regsvr32.exe	30
PID 3020 wrote to memory of 2640	3020	regsvr32.exe	30
PID 3020 wrote to memory of 2640	3020	regsvr32.exe	30
PID 3020 wrote to memory of 2640	3020	regsvr32.exe	30
PID 3020 wrote to memory of 2640	3020	regsvr32.exe	30
PID 3020 wrote to memory of 2640	3020	regsvr32.exe	30
PID 3020 wrote to memory of 2640	3020	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AddIn\VisLrc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\AddIn\VisLrc.dll
  2⤵
  - Modifies registry class
  PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2640-0-0x0000000011000000-0x0000000011008000-memory.dmp

Filesize
32KB

Download