c72666a1d3f15c7446da228e214500a44177fd0db7275be69e89291d72d090b7

Analysis

max time kernel
139s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c72666a1d3f15c7446da228e214500a44177fd0db7275be69e89291d72d090b7.dll
Size

311KB
MD5

64b3a74b344b34ff6fb8041a5b71b200
SHA1

226df3e75485b73a9f23abab36af5226f205c972
SHA256

c72666a1d3f15c7446da228e214500a44177fd0db7275be69e89291d72d090b7
SHA512

c479cd205b7a0cfa91f9242c163a03fda0bd81635ebfcd1b1072f04713fc36db2cba413ff84e5b6c2e3cec6e3745ada2258fb3f3564b7f50e6df3579c2a8963c
SSDEEP

6144:yCnUHYupMgts5/Few368XEZLRW6uPB0Rz+HC9PDwNaDM0eYn:y0UhU4jWVBoz+HC9bLo0eYn

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3376	regsvr32mgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000022e14-136.dat	upx
behavioral2/files/0x0008000000022e14-135.dat	upx
behavioral2/memory/3376-137-0x0000000000400000-0x000000000045D000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\regsvr32mgr.exe	regsvr32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4848	3376	WerFault.exe	82

Modifies registry class 50 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\VersionIndependentProgID\ = "SRS_APO_Universal.SRS_LFX_APO_Universal"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA84AE12-3162-4605-A986-39FA92BBF9AB}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\Flags = "13"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SRS_APO_Universal.SRS_LFX_APO_Universal.1\CLSID\ = "{176F4E15-8F7C-4833-ADED-81FAE8CCD186}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SRS_APO_Universal.SRS_LFX_APO_Universal\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SRS_APO_Universal.SRS_LFX_APO_Universal\CLSID\ = "{176F4E15-8F7C-4833-ADED-81FAE8CCD186}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA84AE12-3162-4605-A986-39FA92BBF9AB}\1.0\ = "SRS_APO_Universal 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA84AE12-3162-4605-A986-39FA92BBF9AB}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA84AE12-3162-4605-A986-39FA92BBF9AB}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\MinorVersion = "0"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\MinOutputConnections = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\ProgID\ = "SRS_APO_Universal.SRS_LFX_APO_Universal.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA84AE12-3162-4605-A986-39FA92BBF9AB}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c72666a1d3f15c7446da228e214500a44177fd0db7275be69e89291d72d090b7.dll"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\MajorVersion = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\MinInputConnections = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SRS_APO_Universal.SRS_LFX_APO_Universal\CurVer\ = "SRS_APO_Universal.SRS_LFX_APO_Universal.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c72666a1d3f15c7446da228e214500a44177fd0db7275be69e89291d72d090b7.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA84AE12-3162-4605-A986-39FA92BBF9AB}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{553C48B2-BA6B-412B-9F8D-2B62B1B912AA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SRS_APO_Universal.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\ = "SRS_LFX_APO_Universal Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA84AE12-3162-4605-A986-39FA92BBF9AB}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA84AE12-3162-4605-A986-39FA92BBF9AB}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\FriendlyName = "SRS LFX APO"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\Copyright = "Copyright (c) 2007 SRS Labs, Inc."	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\MaxInstances = "4294967295"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SRS_APO_Universal.SRS_LFX_APO_Universal.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SRS_APO_Universal.SRS_LFX_APO_Universal\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{553C48B2-BA6B-412B-9F8D-2B62B1B912AA}\ = "SRS_APO_Universal"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SRS_APO_Universal.SRS_LFX_APO_Universal	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SRS_APO_Universal.SRS_LFX_APO_Universal\ = "SRS_LFX_APO_Universal Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\NumAPOInterfaces = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SRS_APO_Universal.DLL\AppID = "{553C48B2-BA6B-412B-9F8D-2B62B1B912AA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA84AE12-3162-4605-A986-39FA92BBF9AB}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\AppID = "{553C48B2-BA6B-412B-9F8D-2B62B1B912AA}"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\MaxInputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\MaxOutputConnections = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\APOInterface0 = "{78BA3745-82F8-47A1-8D99-AB586DCE0572}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SRS_APO_Universal.SRS_LFX_APO_Universal.1\ = "SRS_LFX_APO_Universal Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SRS_APO_Universal.SRS_LFX_APO_Universal.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\TypeLib\ = "{EA84AE12-3162-4605-A986-39FA92BBF9AB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA84AE12-3162-4605-A986-39FA92BBF9AB}\1.0\HELPDIR	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 4528	3552	regsvr32.exe	81
PID 3552 wrote to memory of 4528	3552	regsvr32.exe	81
PID 3552 wrote to memory of 4528	3552	regsvr32.exe	81
PID 4528 wrote to memory of 3376	4528	regsvr32.exe	82
PID 4528 wrote to memory of 3376	4528	regsvr32.exe	82
PID 4528 wrote to memory of 3376	4528	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c72666a1d3f15c7446da228e214500a44177fd0db7275be69e89291d72d090b7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c72666a1d3f15c7446da228e214500a44177fd0db7275be69e89291d72d090b7.dll
  2⤵
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\SysWOW64\regsvr32mgr.exe
    C:\Windows\SysWOW64\regsvr32mgr.exe
    3⤵
    - Executes dropped EXE
    PID:3376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 264
      4⤵
      Program crash
      PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3376 -ip 3376
1⤵
PID:508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\regsvr32mgr.exe

Filesize
132KB

MD5
ebc35bf5774a4b75cd45638cecb74db3

SHA1
3a4858d3ab2074b6d2d5a999a7443c683af2417b

SHA256
52c970b575040b26c6c357f1aa64288544578a229b9be70acd0f860f55cca346

SHA512
365feb8dccdbf66ff9dd5e1aa08126b0c6da0cb1fe6cf7a986cbb6c66928f7c3282492c11946598652e18fa695f7ea7021cd3f5943a20650e9efe829a0891ca1

Download Submit
C:\Windows\SysWOW64\regsvr32mgr.exe

Filesize
132KB

MD5
ebc35bf5774a4b75cd45638cecb74db3

SHA1
3a4858d3ab2074b6d2d5a999a7443c683af2417b

SHA256
52c970b575040b26c6c357f1aa64288544578a229b9be70acd0f860f55cca346

SHA512
365feb8dccdbf66ff9dd5e1aa08126b0c6da0cb1fe6cf7a986cbb6c66928f7c3282492c11946598652e18fa695f7ea7021cd3f5943a20650e9efe829a0891ca1

Download Submit
memory/3376-137-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4528-134-0x00000000750D0000-0x0000000075122000-memory.dmp

Filesize
328KB

Download