ac6d3f36922917f8ac7873fbc4a0a06334daf12c04bd6e4809ff56d7c2283a84

Analysis

max time kernel
94s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

联通宽带拨号客户端/WINHTTP5.dll
Size

284KB
MD5

1d030bf7c36f7998d3783af54eb0cf92
SHA1

b27c12c5cd60f25c33049a7a46db10e6640165e6
SHA256

a648e8e8b73a750007e73db5a6a0e39852498fcfb4ca587dbe16d19630ee54de
SHA512

bdd370b1a4b6db07fabbb688115d7d7c882662b892b8f88fad2600eead642ac899f3d9a9f637355b889e5d1dbe7409ccdc6ace5fd3d62e37fbec59e872b500da
SSDEEP

6144:HHMjSWGK4dwIHLsjwUlIf9myzLnUW2Npzwtkp5LHb3X8fcA9eLYleY5THa:aSJzH7fRc5/n8kA9e8LE

Score

1^/10

Malware Config

Signatures

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}\ProgID\ = "WinHttp.WinHttpRequest.5"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}\ = "WinHttpRequest Component"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}\TypeLib\ = "{c92a03cf-b92b-404f-9ac5-58664a592e4c}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinHttp.WinHttpRequest.5\CLSID\ = "{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}\InProcServer32\ = "%SystemDrive%\\Users\\Admin\\AppData\\Local\\Temp\\?????????\\WINHTTP5.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91e2ead3-ab7e-4d5c-88de-f7fa382172bc}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinHttp.WinHttpRequest.5	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinHttp.WinHttpRequest.5\ = "WinHttpRequest Component"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinHttp.WinHttpRequest.5\CLSID	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 2008	4928	regsvr32.exe	83
PID 4928 wrote to memory of 2008	4928	regsvr32.exe	83
PID 4928 wrote to memory of 2008	4928	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\联通宽带拨号客户端\WINHTTP5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\联通宽带拨号客户端\WINHTTP5.dll
  2⤵
  - Modifies registry class
  PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RGIAF89.tmp

Filesize
1022B

MD5
df20eaadd49b801c0d7be5198c5c961d

SHA1
13bbf5c7f5ba2118784b010a00508bbbaeb54394

SHA256
84c11356b733e82ee4c866b17421fdb9b39e804427de2e0ea6c52eba4ffb20c3

SHA512
4e58c0013b8e689e84d214341b13e65802f85134fd75192a3b2d5ac085a71cb791f4e262786fc265c4cfe633360963997009c49cd71802089e2d5abe0042a1c0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads