740f8595ef342aebf327a41e9f9eca2a2a19446c9a06f982039656c787124b17 | Triage

Analysis

max time kernel
47s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 21:16

Sharing

Report Analysis Logs

General

Target

MediaGatewayX.dll
Size

33KB
MD5

126e6eeac26f5ec81bfd7ebc1cdd2b88
SHA1

63160dc5b7881c2542ce4536082f2fd7bb8a2c95
SHA256

0f6711befb880df29d648c5d4e1b3f66449c59e6ccd3449fd80df27d688f589d
SHA512

d5ceffe76c2ef320722f818d80a6b350808eb7d5857c8ffd32a34dbfd5f6b6c04f690b12af79e88ff64532c95a397a5ef0f51dd4fa6f89a56c56668539f0fe1b
SSDEEP

768:+9+QttQpplldrlTQ7b3RDUOxJQ/vB0Mh/ZhC0Yj1ff:YmdrlMDRDrxJQ/vB0MhJaX

Score

1^/10

Malware Config

Signatures

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MediaGatewayX.Installer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MediaGatewayX.Installer\CLSID\ = "{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MediaGatewayX.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MediaGatewayX.Installer\ = "MediaGatewayX.Installer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MediaGatewayX.Installer\CLSID	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 840	1364	regsvr32.exe	26
PID 1364 wrote to memory of 840	1364	regsvr32.exe	26
PID 1364 wrote to memory of 840	1364	regsvr32.exe	26
PID 1364 wrote to memory of 840	1364	regsvr32.exe	26
PID 1364 wrote to memory of 840	1364	regsvr32.exe	26
PID 1364 wrote to memory of 840	1364	regsvr32.exe	26
PID 1364 wrote to memory of 840	1364	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\MediaGatewayX.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\MediaGatewayX.dll
  2⤵
  - Modifies registry class
  PID:840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/840-56-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1364-54-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

Filesize
8KB

Download