c01c0bce2f0088ebdd2f006b207ab1a2e033c455c59fc21b4e8bffcd2fd20077

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UUUpgrade.dll
Size

173KB
MD5

883183e3dce3ea4bec84f89628ce92c0
SHA1

7762e355b3957ce7b001a0a47e6a526c456502c0
SHA256

ff31c8a31b8aba99de7bc595655be66a4fd8cc4d8f1a1420dea86c7594585902
SHA512

e70011e1f7f1ac8245af35128001080b160144dee684ccef3151789396c25791a144736ee94711b103c44a99f3a4a43cfe43486a466db4f11215264f682dead2
SSDEEP

3072:aWxMpzP/FhShiZ0LlFrSsR0ssN1a0IL5ok5Natmo/cPp:iP/nc3lRoN25oMG3Eh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F39804DC-F2B5-4E8B-92F1-45F7B5349C4C}\TypeLib\ = "{BC85539C-48EA-4222-B6EE-8DA6897175DA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F39804DC-F2B5-4E8B-92F1-45F7B5349C4C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{03536919-5F7D-4506-80DF-144C74CB5B45}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{03536919-5F7D-4506-80DF-144C74CB5B45}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{03536919-5F7D-4506-80DF-144C74CB5B45}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03536919-5F7D-4506-80DF-144C74CB5B45}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BC85539C-48EA-4222-B6EE-8DA6897175DA}\1.0\FLAGS\ = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F39804DC-F2B5-4E8B-92F1-45F7B5349C4C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F39804DC-F2B5-4E8B-92F1-45F7B5349C4C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F39804DC-F2B5-4E8B-92F1-45F7B5349C4C}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F39804DC-F2B5-4E8B-92F1-45F7B5349C4C}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F39804DC-F2B5-4E8B-92F1-45F7B5349C4C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\ProgID\ = "UUUPGRADE.UUUpgradeCtrl.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BC85539C-48EA-4222-B6EE-8DA6897175DA}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F39804DC-F2B5-4E8B-92F1-45F7B5349C4C}\ = "_DUUUpgrade"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{03536919-5F7D-4506-80DF-144C74CB5B45}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{03536919-5F7D-4506-80DF-144C74CB5B45}\TypeLib\ = "{BC85539C-48EA-4222-B6EE-8DA6897175DA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F0E7BAF1-655E-4899-ACD4-10D055414CFB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BC85539C-48EA-4222-B6EE-8DA6897175DA}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F39804DC-F2B5-4E8B-92F1-45F7B5349C4C}\ = "_DUUUpgrade"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F0E7BAF1-655E-4899-ACD4-10D055414CFB}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UUUPGRADE.UUUpgradeCtrl.1\CLSID\ = "{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03536919-5F7D-4506-80DF-144C74CB5B45}\TypeLib\ = "{BC85539C-48EA-4222-B6EE-8DA6897175DA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUUPGRADE.UUUpgradeCtrl.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UUUPGRADE.UUUpgradeCtrl.1\ = "UUUpgrade Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\Control\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BC85539C-48EA-4222-B6EE-8DA6897175DA}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BC85539C-48EA-4222-B6EE-8DA6897175DA}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03536919-5F7D-4506-80DF-144C74CB5B45}\ = "_DUUUpgradeEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03536919-5F7D-4506-80DF-144C74CB5B45}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03536919-5F7D-4506-80DF-144C74CB5B45}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UUUPGRADE.UUUpgradeCtrl.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BC85539C-48EA-4222-B6EE-8DA6897175DA}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F0E7BAF1-655E-4899-ACD4-10D055414CFB}\ = "UUUpgrade Property Page"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BC85539C-48EA-4222-B6EE-8DA6897175DA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BC85539C-48EA-4222-B6EE-8DA6897175DA}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{03536919-5F7D-4506-80DF-144C74CB5B45}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\UUUPGR~1.DLL, 1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BC85539C-48EA-4222-B6EE-8DA6897175DA}\1.0\ = "UUUpgrade ActiveX Control module"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BC85539C-48EA-4222-B6EE-8DA6897175DA}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\UUUpgrade.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F39804DC-F2B5-4E8B-92F1-45F7B5349C4C}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\MiscStatus\1\ = "131473"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F39804DC-F2B5-4E8B-92F1-45F7B5349C4C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F39804DC-F2B5-4E8B-92F1-45F7B5349C4C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{03536919-5F7D-4506-80DF-144C74CB5B45}\ = "_DUUUpgradeEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2CACD7BB-1C59-4BBB-8E81-6E83F82C813B}\TypeLib\ = "{BC85539C-48EA-4222-B6EE-8DA6897175DA}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2396	2540	regsvr32.exe	30
PID 2540 wrote to memory of 2396	2540	regsvr32.exe	30
PID 2540 wrote to memory of 2396	2540	regsvr32.exe	30
PID 2540 wrote to memory of 2396	2540	regsvr32.exe	30
PID 2540 wrote to memory of 2396	2540	regsvr32.exe	30
PID 2540 wrote to memory of 2396	2540	regsvr32.exe	30
PID 2540 wrote to memory of 2396	2540	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\UUUpgrade.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\UUUpgrade.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...