b51105615d31ef7388b9ffbf670133cb173d1e7a7100bfef0b93e2b6e58b9142

Analysis

max time kernel
186s
max time network
260s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Team Tools/Dynamic Code Coverage Tools/msdia110.dll
Size

868KB
MD5

3c2c91154546602b70c82069d31bee7e
SHA1

cb0067ebc8a6ef8f5b3d8eb7ef91a24d262af04d
SHA256

3170c85159f32ffc93edb752b34003859904da64e2e4da54e9fa03e1142bb7d7
SHA512

ceabec5f60dc1e3d423eeb0ad069104f668982460baa5845728cf6fd4f7322c6095f74550fbdc7da9a754db400602274b6a9cf0399f5071de1fdb047a1e3bddb
SSDEEP

12288:hch7L05KLSukOtyAX841kLTU291YXGYug6ouBR620oG5h7BAEdR:hwhIW84mL07FoutA

Score

1^/10

Malware Config

Signatures

Modifies registry class 26 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D793FB46-820A-48E5-9599-6E4C3B3FB370}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC259D4D-398E-4CFF-84FD-5F44DC9DE367}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC259D4D-398E-4CFF-84FD-5F44DC9DE367}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Team Tools\\Dynamic Code Coverage Tools\\msdia110.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC259D4D-398E-4CFF-84FD-5F44DC9DE367}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\ = "dia 2.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{761D3BCD-1304-41D5-94E8-EAC54E4AC172}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{761D3BCD-1304-41D5-94E8-EAC54E4AC172}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Team Tools\\Dynamic Code Coverage Tools\\msdia110.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\WOW6432Node\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D793FB46-820A-48E5-9599-6E4C3B3FB370}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{761D3BCD-1304-41D5-94E8-EAC54E4AC172}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D793FB46-820A-48E5-9599-6E4C3B3FB370}\ = "Debug Information Accessor w/o Global Memory Usage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{761D3BCD-1304-41D5-94E8-EAC54E4AC172}\ = "Debug Information Accessor"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Team Tools\\Dynamic Code Coverage Tools"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Team Tools\\Dynamic Code Coverage Tools\\msdia110.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{761D3BCD-1304-41D5-94E8-EAC54E4AC172}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D793FB46-820A-48E5-9599-6E4C3B3FB370}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Team Tools\\Dynamic Code Coverage Tools\\msdia110.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC259D4D-398E-4CFF-84FD-5F44DC9DE367}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D793FB46-820A-48E5-9599-6E4C3B3FB370}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC259D4D-398E-4CFF-84FD-5F44DC9DE367}\ = "Generic StackWalker"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1392 wrote to memory of 3856	1392	regsvr32.exe	regsvr32.exe
PID 1392 wrote to memory of 3856	1392	regsvr32.exe	regsvr32.exe
PID 1392 wrote to memory of 3856	1392	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Team Tools\Dynamic Code Coverage Tools\msdia110.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\SysWOW64\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\Team Tools\Dynamic Code Coverage Tools\msdia110.dll"
2⤵
- Modifies registry class
PID:3856

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads