8c8d10fbaaa935d58148cd1d2aadcac64b019acd2a93a4f55daa0328c537a0f0

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$R0.dll
Size

1020KB
MD5

1fa6a59a5188919d09d5178b0b362da1
SHA1

6276f375cabd936d1ccf9d62205b6d6fc67e1fe1
SHA256

cb8c12da631ff940d1eae329f0f2f1d51de1af7ac9639b63b30eb769a8245c36
SHA512

ad1682a71dd68f680972487a7b7dd2c52db2a198f82a4d57fa38cf12c21bd085bfb14b071454c6a560d86770d72a8ab7409725e302f60d7399832d4e07eb81e5
SSDEEP

12288:HMYppA2Efka9I+C4RQBtfexvqWGX+zMIP++AA38xSQEhO3qXCDCV:lpAJWVA8USD

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB227965-AECE-419F-B20D-ABD1C7FCD182}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A0361BE-1728-4F34-A074-F24206CA3246}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4C961D2F-9E61-443B-AB21-E4B8D91797E2}\TypeLib\ = "{3C5FDEAE-F248-4334-A339-6B1FB65F01F5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4966045-FD64-4B42-BE44-00C0B223CB9F}\Control\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB227965-AECE-419F-B20D-ABD1C7FCD182}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB227965-AECE-419F-B20D-ABD1C7FCD182}\Required Categories\{D40C2700-FFA1-11CF-8234-00AA00C1AB85}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VbGUI.pcMouse	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F40C09D3-1F1D-47ED-B800-034B95D4F3B0}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8354C2B8-9C45-4D6F-AA26-1F13BF4D805E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VbGUI.cGrid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{56341C47-31CC-42A5-96A9-55170970D402}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D208B08D-51F5-4C9C-8250-49F411E66FD8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57A053AE-6105-4F48-9634-01585D96E3FB}\ = "_cTreeView"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E4485C3F-4870-41AF-88B7-3BB2775E25AD}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E4485C3F-4870-41AF-88B7-3BB2775E25AD}\TypeLib\ = "{3C5FDEAE-F248-4334-A339-6B1FB65F01F5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D208B08D-51F5-4C9C-8250-49F411E66FD8}\ = "_pcMouse"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VbGUI.cSysTray	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8FDDBF6D-A1CC-4A40-BCA0-3E499943125B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8FDDBF6D-A1CC-4A40-BCA0-3E499943125B}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25A11C59-91FB-48DF-8D1A-C51DC5FDF01D}\ProgID\ = "VbGUI.cProgressBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E95DAAC3-9C64-4947-A17E-83A8A8B95893}\ = "_cProgressBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB09EABA-5F7D-4BB5-A380-CB0119D14FBD}\ = "_cReBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5FE5C063-45B0-4083-9A05-AF886FB7BFE7}\ = "_cControlBalloonXP"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VbGUI.IGridCellOwnerDraw\Clsid\ = "{42D79628-0471-4AE6-9B27-9C2E07ADFDC5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E95DAAC3-9C64-4947-A17E-83A8A8B95893}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4283F0D7-F578-4664-87FB-3AE40B89B764}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D208B08D-51F5-4C9C-8250-49F411E66FD8}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C501085B-542B-4EF7-AAA1-EAE1A45CCB3A}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91F46992-9CB2-4E9B-A98E-4786C04F6DE2}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B67DCD02-CBB7-48EB-A91B-EE2B99B034D1}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8354C2B8-9C45-4D6F-AA26-1F13BF4D805E}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8354C2B8-9C45-4D6F-AA26-1F13BF4D805E}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4966045-FD64-4B42-BE44-00C0B223CB9F}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll, 30002"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DFAD9657-3A7A-41EA-ADED-2109EBD97FAE}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4AFA46FF-127D-44AA-9987-4348B192FA0D}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4512A5D2-A7B2-4A58-BB69-5068C5BBC962}\TypeLib\ = "{3C5FDEAE-F248-4334-A339-6B1FB65F01F5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54A5403D-D9FC-4A51-95A7-C87508FE9848}\TypeLib\ = "{3C5FDEAE-F248-4334-A339-6B1FB65F01F5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FA32DD65-1DE0-4E30-A191-207AC932F058}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FF8FD300-7983-4243-8208-CEE52A24BE59}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{804FFF08-EA75-4FB4-9620-9B266C9CE5C1}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8DC0FED3-2F04-4C92-8AAD-27E1570C0B47}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E95DAAC3-9C64-4947-A17E-83A8A8B95893}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4283F0D7-F578-4664-87FB-3AE40B89B764}\TypeLib\ = "{3C5FDEAE-F248-4334-A339-6B1FB65F01F5}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{059BF6B1-D0F7-406F-A174-7FDC16DE81E0}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56341C47-31CC-42A5-96A9-55170970D402}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C961D2F-9E61-443B-AB21-E4B8D91797E2}\TypeLib\ = "{3C5FDEAE-F248-4334-A339-6B1FB65F01F5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE6C1F14-7478-47AF-BEF2-147207879061}\Control\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BC18916-394A-4965-8678-F2039CA9663A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VbGUI.ISubclass\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42D79628-0471-4AE6-9B27-9C2E07ADFDC5}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25A11C59-91FB-48DF-8D1A-C51DC5FDF01D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4512A5D2-A7B2-4A58-BB69-5068C5BBC962}\TypeLib\ = "{3C5FDEAE-F248-4334-A339-6B1FB65F01F5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45EF7CC1-5422-45B1-A64E-943F7EAFABF2}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4512A5D2-A7B2-4A58-BB69-5068C5BBC962}\ = "_cPopupMenu"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0967FD2-13E0-499C-A112-4FB0C060A0D5}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F40C09D3-1F1D-47ED-B800-034B95D4F3B0}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll, 30006"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{56A33B5E-60BD-4218-AFD3-F21A8642AF8D}\TypeLib\ = "{3C5FDEAE-F248-4334-A339-6B1FB65F01F5}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A668E0B-8C89-474C-9EAC-1821A15DD011}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5FE5C063-45B0-4083-9A05-AF886FB7BFE7}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{04D6ED44-77B3-4495-9034-308BE05764DA}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4283F0D7-F578-4664-87FB-3AE40B89B764}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB204564-D355-4321-8B66-9379EA4C5645}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55B40B0C-865B-417C-A86E-AB4120E631D7}\ = "__cPopupMenu"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E298AD6-6878-40A8-A5C8-88D81BC90733}\TypeLib	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2416	2468	regsvr32.exe	29
PID 2468 wrote to memory of 2416	2468	regsvr32.exe	29
PID 2468 wrote to memory of 2416	2468	regsvr32.exe	29
PID 2468 wrote to memory of 2416	2468	regsvr32.exe	29
PID 2468 wrote to memory of 2416	2468	regsvr32.exe	29
PID 2468 wrote to memory of 2416	2468	regsvr32.exe	29
PID 2468 wrote to memory of 2416	2468	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$R0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$R0.dll
  2⤵
  - Modifies registry class
  PID:2416

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads