d618b457c1310790385c4efeb88e8afaa61876e42b17bc329bb148694a4b5a00

Analysis

max time kernel
135s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$APPDATA/test/formsend/vcbuild.dll
Size

11KB
MD5

1b84d7e16763d4686874c20e07437bec
SHA1

9d3088e977c5b6a322bdeb538487a73887fbcc0e
SHA256

a020d37724b738aab3c295917b6a23f8de45449177615a88e7c93627de424280
SHA512

4f9715ed1d8473c884965688dc9e4c06d53143240909c096ef340ed3e4ddf157331b0417fcb334a5c8b2b7c25b609f21262d8f3863567e3cbb4e05a3396f4821
SSDEEP

192:IIeYBmMNCZ2LjRj23/pv6u5TN3XSGMKS6vrkrbAVuWDxpBSWNLft5AgI/:LNBma2GjR23/IuToKS68nWD0WlftpW

Score

1^/10

Malware Config

Signatures

Modifies registry class 25 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB512}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB513}\ProxyStubClsid32\ = "{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB513}\NumMethods	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}\ = "IVCBuildErrorContext"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}\NumMethods\ = "27"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB512}\ = "IENCBuildSpawnerCallback"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB512}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB513}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\WOW6432Node\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB512}\ProxyStubClsid32\ = "{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}\ = "PSFactoryBuffer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB512}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB513}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$APPDATA\\test\\formsend\\vcbuild.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB513}\ = "IENCBuildSpawner"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB512}\NumMethods\ = "4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79050497-F1F0-4BFA-A337-1DB93CEEB513}\NumMethods\ = "6"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}\ProxyStubClsid32\ = "{52F14F3A-90EA-4307-8E01-CDECFE97D4D1}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4052 wrote to memory of 1288	4052	regsvr32.exe	regsvr32.exe
PID 4052 wrote to memory of 1288	4052	regsvr32.exe	regsvr32.exe
PID 4052 wrote to memory of 1288	4052	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$APPDATA\test\formsend\vcbuild.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4052

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\$APPDATA\test\formsend\vcbuild.dll
2⤵
- Modifies registry class
PID:1288

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads