Overview
overview
10Static
static
7872846234.zip
windows7-x64
17872846234.zip
windows10-2004-x64
1DBUG.ps1
windows7-x64
1DBUG.ps1
windows10-2004-x64
1WinSupport...re.dll
windows7-x64
1WinSupport...re.dll
windows10-2004-x64
1WinSupport...32.dll
windows7-x64
1WinSupport...32.dll
windows10-2004-x64
3WinSupport...EK.dll
windows7-x64
1WinSupport...EK.dll
windows10-2004-x64
1WinSupport...32.dll
windows7-x64
1WinSupport...32.dll
windows10-2004-x64
1WinSupport...32.dll
windows7-x64
1WinSupport...32.dll
windows10-2004-x64
1WinSupport...32.exe
windows7-x64
10WinSupport...32.exe
windows10-2004-x64
10WinSupport...00.dll
windows7-x64
3WinSupport...00.dll
windows10-2004-x64
3WinSupport...pi.dll
windows7-x64
1WinSupport...pi.dll
windows10-2004-x64
1WinSupport...ub.exe
windows7-x64
1WinSupport...ub.exe
windows10-2004-x64
1LOCALES/MSAMRNBD.dll
windows7-x64
1LOCALES/MSAMRNBD.dll
windows10-2004-x64
1LOCALES/MSAMRNBE.dll
windows7-x64
1LOCALES/MSAMRNBE.dll
windows10-2004-x64
1LOCALES/MSAUDDEC.dll
windows7-x64
1LOCALES/MSAUDDEC.dll
windows10-2004-x64
1LOCALES/MSAUDITE.dll
windows7-x64
1LOCALES/MSAUDITE.dll
windows10-2004-x64
1LOCALES/PROTONVP.exe
windows7-x64
7LOCALES/PROTONVP.exe
windows10-2004-x64
7Analysis
-
max time kernel
100s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-08-2022 13:38
Static task
static1
Behavioral task
behavioral1
Sample
7872846234.zip
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7872846234.zip
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
DBUG.ps1
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
DBUG.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
WinSupportSn/AudioCapture.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
WinSupportSn/AudioCapture.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
WinSupportSn/HTCTL32.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
WinSupportSn/HTCTL32.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
WinSupportSn/PCICHEK.dll
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
WinSupportSn/PCICHEK.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
WinSupportSn/PCICL32.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
WinSupportSn/PCICL32.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
WinSupportSn/TCCTL32.dll
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
WinSupportSn/TCCTL32.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
WinSupportSn/client32.exe
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
WinSupportSn/client32.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
WinSupportSn/msvcr100.dll
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
WinSupportSn/msvcr100.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
WinSupportSn/pcicapi.dll
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
WinSupportSn/pcicapi.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
WinSupportSn/remcmdstub.exe
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
WinSupportSn/remcmdstub.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
LOCALES/MSAMRNBD.dll
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
LOCALES/MSAMRNBD.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
LOCALES/MSAMRNBE.dll
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
LOCALES/MSAMRNBE.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
LOCALES/MSAUDDEC.dll
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
LOCALES/MSAUDDEC.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
LOCALES/MSAUDITE.dll
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
LOCALES/MSAUDITE.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
LOCALES/PROTONVP.exe
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
LOCALES/PROTONVP.exe
Resource
win10v2004-20220812-en
General
-
Target
LOCALES/MSAMRNBE.dll
-
Size
201KB
-
MD5
312cc1a799f187bdd6872a44e94f51be
-
SHA1
d9717ea3770959859bfd775f02fee7fbe1cf9214
-
SHA256
f90cd8a5ab1200a8b9567fe183b91b2d0f5747d9895b4f1a2f2fdc24ee856d1f
-
SHA512
b6fa6dfafe1bc6171b8fe1e2e0afbbc673bed52a7f101cfae634ae5bba912b6d288d736e2ef35032e4de917c0d10cb844b7767f45cf6fe10e22d6f6eda48f8f3
-
SSDEEP
6144:Zratq0WGuUgMcPtHl6O5COtYzc7iJT9j:EtpWGgPTGc76j
Malware Config
Signatures
-
Modifies registry class 13 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{2FAE8AFE-04A3-423a-A814-85DB454712B0}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2FAE8AFE-04A3-423a-A814-85DB454712B0}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\2FAE8AFE-04A3-423a-A814-85DB454712B0\ = "MS AMRNB Encoder MFT" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\2FAE8AFE-04A3-423a-A814-85DB454712B0\OutputTypes = 6175647300001000800000aa00389b716173000000001000800000aa00389b716175647300001000800000aa00389b71726d61737a764d49b478f29d25dc9037 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\Categories\91c64bd0-f91e-4d8c-9276-db248279d975\2fae8afe-04a3-423a-a814-85db454712b0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\Categories\91c64bd0-f91e-4d8c-9276-db248279d975 regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{2FAE8AFE-04A3-423a-A814-85DB454712B0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2FAE8AFE-04A3-423a-A814-85DB454712B0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\2fae8afe-04a3-423a-a814-85db454712b0 regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\2FAE8AFE-04A3-423a-A814-85DB454712B0\InputTypes = 6175647300001000800000aa00389b710100000000001000800000aa00389b71 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\Categories regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 3128 wrote to memory of 4112 3128 regsvr32.exe regsvr32.exe PID 3128 wrote to memory of 4112 3128 regsvr32.exe regsvr32.exe PID 3128 wrote to memory of 4112 3128 regsvr32.exe regsvr32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4112-132-0x0000000000000000-mapping.dmp