26a30811833fd93ecb266b4e2287e9b30cb99aff38e5109398462946fced4ab0 | Triage

Analysis

max time kernel
152s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22-08-2022 09:21

Sharing

Report Analysis Logs

General

Target

LOCALES/MSAMRNBD.dll
Size

128KB
MD5

b8575c2ba2ac7255c9c1f2c809bdd730
SHA1

1b22df2dfcc5dc6143f1ec2c852f9ebd814ba5e0
SHA256

d303638cb83a7e2651e74e20db52691805b43fa222f2cc98e2b02cfb8536b8b2
SHA512

93c9955c63a0c9ef4296cea8efb58094332bf8ae1e3f25692ea16fd8893aec31dfafdd4ba70365d08a57a8c1fa121794fa4e2fe0b49c071f425cb5b6405d96e6

Score

1^/10

Malware Config

Signatures

Modifies registry class 13 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\265011AE-5481-4f77-A295-ABB6FFE8D63E\InputTypes = 6175647300001000800000aa00389b716173000000001000800000aa00389b716175647300001000800000aa00389b71726d61737a764d49b478f29d25dc9037	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\265011AE-5481-4f77-A295-ABB6FFE8D63E\OutputTypes = 6175647300001000800000aa00389b710100000000001000800000aa00389b71	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\Categories\9ea73fb4-ef7a-4559-8d5d-719d8f0426c7	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{265011AE-5481-4f77-A295-ABB6FFE8D63E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{265011AE-5481-4f77-A295-ABB6FFE8D63E}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\265011AE-5481-4f77-A295-ABB6FFE8D63E\ = "MS AMRNB Decoder MFT"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\Categories\9ea73fb4-ef7a-4559-8d5d-719d8f0426c7\265011ae-5481-4f77-a295-abb6ffe8d63e	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265011AE-5481-4f77-A295-ABB6FFE8D63E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265011AE-5481-4f77-A295-ABB6FFE8D63E}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\265011ae-5481-4f77-a295-abb6ffe8d63e	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1640 wrote to memory of 5048	1640	regsvr32.exe	regsvr32.exe
PID 1640 wrote to memory of 5048	1640	regsvr32.exe	regsvr32.exe
PID 1640 wrote to memory of 5048	1640	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\LOCALES\MSAMRNBD.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\LOCALES\MSAMRNBD.dll
2⤵
- Modifies registry class
PID:5048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5048-132-0x0000000000000000-mapping.dmp

Download