41bbbe806b787ebbd8f8ac5f813a00ed4b822e500ecacabcd3ff94ff21e06c24

Analysis

max time kernel
41s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DPlayer_lv/VSFilter.dll
Size

960KB
MD5

bfcb5a1850a5dab1844e59787c5221cc
SHA1

0ba07e5d7efea4c68daf9e83552474fe3ceef4b4
SHA256

168395de64c0970c0e9b52ac0107eec815cee76f666576ebc51c5157b36430cf
SHA512

b52ce5b0687730ddfb0bb6c2c976c2a78068f63d2c6a7eee97796a39b126d3f097844ef34995fec951488cc9f777df602b6722b82bd3a94b6f0c5d56b24138a2
SSDEEP

24576:XcAuQ8jtlI4+GRiQwEOPAP7s85MhcwkIyk:Go4riQgATl5Mhc6

Score

1^/10

Malware Config

Signatures

Modifies registry class 58 IoCs

Processes:

regsvr32.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{525F116F-04AD-40A2-AE2F-A0C4E1AFEF98}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D6D98F-09CA-4524-AF64-1049B5665C9C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D6D98F-09CA-4524-AF64-1049B5665C9C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DPlayer_lv\\VSFilter.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93A22E7A-5091-45EF-BA61-6DA26156A5D0}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9852A670-F845-491B-9BE6-EBD841B8A613}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DPlayer_lv\\VSFilter.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60765CF5-01C2-4EE7-A44B-C791CF25FEA0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DPlayer_lv\\VSFilter.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9852A670-F845-491B-9BE6-EBD841B8A613}\ = "DirectVobSub (auto-loading version)"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0180E49C-13BF-46DB-9AFD-9F52292E1C22}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE77C59C-CFD2-429F-868C-8B04D23F94CA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F544E0F5-CA3C-47EA-A64D-35FCF1602396}\ = "DVSAboutPPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9852A670-F845-491B-9BE6-EBD841B8A613}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60765CF5-01C2-4EE7-A44B-C791CF25FEA0}\ = "DVSMainPPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D6D98F-09CA-4524-AF64-1049B5665C9C}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93A22E7A-5091-45EF-BA61-6DA26156A5D0}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9852A670-F845-491B-9BE6-EBD841B8A613}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{525F116F-04AD-40A2-AE2F-A0C4E1AFEF98}\ = "DVSZoomPPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F544E0F5-CA3C-47EA-A64D-35FCF1602396}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0180E49C-13BF-46DB-9AFD-9F52292E1C22}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ACE4747B-35BD-4E97-9DD7-1D4245B0695C}\ = "DVSTimingPPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{525F116F-04AD-40A2-AE2F-A0C4E1AFEF98}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE77C59C-CFD2-429F-868C-8B04D23F94CA}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{93A22E7A-5091-45EF-BA61-6DA26156A5D0}\CLSID = "{93A22E7A-5091-45EF-BA61-6DA26156A5D0}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93A22E7A-5091-45EF-BA61-6DA26156A5D0}\ = "DirectVobSub"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8B25C0E-0894-4531-B668-AB1599FAF7F6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ACE4747B-35BD-4E97-9DD7-1D4245B0695C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DPlayer_lv\\VSFilter.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60765CF5-01C2-4EE7-A44B-C791CF25FEA0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0180E49C-13BF-46DB-9AFD-9F52292E1C22}\ = "DVSGeneralPPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ACE4747B-35BD-4E97-9DD7-1D4245B0695C}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D6D98F-09CA-4524-AF64-1049B5665C9C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8B25C0E-0894-4531-B668-AB1599FAF7F6}\ = "DVSMiscPPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60765CF5-01C2-4EE7-A44B-C791CF25FEA0}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0180E49C-13BF-46DB-9AFD-9F52292E1C22}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DPlayer_lv\\VSFilter.dll"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{93A22E7A-5091-45EF-BA61-6DA26156A5D0}\FilterData = 02000000000020000300000000000000307069330000000000000000090000000000000000000000307479330000000008010000080100003174793300000000180100002801000032747933000000001801000038010000337479330000000018010000480100003474793300000000180100005801000035747933000000001801000068010000367479330000000018010000780100003774793300000000180100008801000038747933000000001801000098010000317069330800000000000000010000000000000000000000307479330000000018010000a80100003270693306000000000000000100000000000000000000003074793300000000b8010000a8010000000000000000000000000000000000007669647300001000800000aa00389b715955593200001000800000aa00389b715956313200001000800000aa00389b714934323000001000800000aa00389b714959555600001000800000aa00389b717eeb36e44f52ce119f530020af0ba7707beb36e44f52ce119f530020af0ba7707ceb36e44f52ce119f530020af0ba7707deb36e44f52ce119f530020af0ba7708eeb36e44f52ce119f530020af0ba7707478747300001000800000aa00389b71	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{9852A670-F845-491B-9BE6-EBD841B8A613}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93A22E7A-5091-45EF-BA61-6DA26156A5D0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{93A22E7A-5091-45EF-BA61-6DA26156A5D0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DPlayer_lv\\VSFilter.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9852A670-F845-491B-9BE6-EBD841B8A613}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8B25C0E-0894-4531-B668-AB1599FAF7F6}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8B25C0E-0894-4531-B668-AB1599FAF7F6}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE77C59C-CFD2-429F-868C-8B04D23F94CA}\ = "DVSPathsPPage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE77C59C-CFD2-429F-868C-8B04D23F94CA}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DPlayer_lv\\VSFilter.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{9852A670-F845-491B-9BE6-EBD841B8A613}\FriendlyName = "DirectVobSub (auto-loading version)"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{525F116F-04AD-40A2-AE2F-A0C4E1AFEF98}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2D6D98F-09CA-4524-AF64-1049B5665C9C}\ = "DVSColorPPage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE77C59C-CFD2-429F-868C-8B04D23F94CA}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F544E0F5-CA3C-47EA-A64D-35FCF1602396}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{9852A670-F845-491B-9BE6-EBD841B8A613}\CLSID = "{9852A670-F845-491B-9BE6-EBD841B8A613}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{93A22E7A-5091-45EF-BA61-6DA26156A5D0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0180E49C-13BF-46DB-9AFD-9F52292E1C22}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8B25C0E-0894-4531-B668-AB1599FAF7F6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DPlayer_lv\\VSFilter.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ACE4747B-35BD-4E97-9DD7-1D4245B0695C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ACE4747B-35BD-4E97-9DD7-1D4245B0695C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{525F116F-04AD-40A2-AE2F-A0C4E1AFEF98}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DPlayer_lv\\VSFilter.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F544E0F5-CA3C-47EA-A64D-35FCF1602396}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F544E0F5-CA3C-47EA-A64D-35FCF1602396}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DPlayer_lv\\VSFilter.dll"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{9852A670-F845-491B-9BE6-EBD841B8A613}\FilterData = 02000000020080000300000000000000307069330000000000000000090000000000000000000000307479330000000008010000080100003174793300000000180100002801000032747933000000001801000038010000337479330000000018010000480100003474793300000000180100005801000035747933000000001801000068010000367479330000000018010000780100003774793300000000180100008801000038747933000000001801000098010000317069330800000000000000010000000000000000000000307479330000000018010000a80100003270693306000000000000000100000000000000000000003074793300000000b8010000a8010000000000000000000000000000000000007669647300001000800000aa00389b715955593200001000800000aa00389b715956313200001000800000aa00389b714934323000001000800000aa00389b714959555600001000800000aa00389b717eeb36e44f52ce119f530020af0ba7707beb36e44f52ce119f530020af0ba7707ceb36e44f52ce119f530020af0ba7707deb36e44f52ce119f530020af0ba7708eeb36e44f52ce119f530020af0ba7707478747300001000800000aa00389b71	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60765CF5-01C2-4EE7-A44B-C791CF25FEA0}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{93A22E7A-5091-45EF-BA61-6DA26156A5D0}\FriendlyName = "DirectVobSub"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	Process	procid_target
PID 996 wrote to memory of 952	996	regsvr32.exe	27
PID 996 wrote to memory of 952	996	regsvr32.exe	27
PID 996 wrote to memory of 952	996	regsvr32.exe	27
PID 996 wrote to memory of 952	996	regsvr32.exe	27
PID 996 wrote to memory of 952	996	regsvr32.exe	27
PID 996 wrote to memory of 952	996	regsvr32.exe	27
PID 996 wrote to memory of 952	996	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\DPlayer_lv\VSFilter.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\DPlayer_lv\VSFilter.dll
  2⤵
  - Modifies registry class
  PID:952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/952-55-0x0000000000000000-mapping.dmp

Download
memory/952-56-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download
memory/996-54-0x000007FEFBBF1000-0x000007FEFBBF3000-memory.dmp

Filesize
8KB

Download