Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
02/11/2023, 15:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.f6fd6ad5f56bc6b669167d99cc480670_JC.dll
Resource
win7-20231023-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.f6fd6ad5f56bc6b669167d99cc480670_JC.dll
Resource
win10v2004-20231023-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
NEAS.f6fd6ad5f56bc6b669167d99cc480670_JC.dll
-
Size
60KB
-
MD5
f6fd6ad5f56bc6b669167d99cc480670
-
SHA1
9fc6d68fbcdbdfde12a413ad4b33ce633bbcae27
-
SHA256
c550fa39f4958ce91ed1c1101279b80feb6e464e45d91e1167558e322d61a1f2
-
SHA512
4df0eda906d69265209f9e43557e4ba55ee542f438bd62d8b5a402d976001b1a24aca15f605657b2165f78807cbfcb5d2503a70f24ab144e6f63e3db39e6887a
-
SSDEEP
1536:eQZU1cfMvRERrzwUnU9CdNpXkhJ/30FmsVM8IfWh:bNMvRERrzwiNpAJ/WCfA
Score
1/10
Malware Config
Signatures
-
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.vg2\shell regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ape\shell\MPCPlayer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rpm regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.rpm\DefaultIcon regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.mpeg\DefaultIcon regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.mkv\shell\ = "Open" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.mpg\shell\ = "Open" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.vp7\shell\ = "Open" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\PNM\EditFlags = 03000000 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rmvb regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.rt\shell\open regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.ivf\ = "Indeo ÊÓƵ" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vp6 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VLC.tta\shell\MPCPlayer\ = "? ???? ??" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\RealPlayer\6.0\Preferences\Satellite15\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.3g2\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FileExt.dll,7" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tp regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.vob\shell regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.IVF\Content Type = "video/x-ivf" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.ivf\shell regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.ratDVD\shell regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.smil regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.3gpp\ = "mpcplayer.3gp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vob\MPCPlayer = "VLC.vob" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.mov\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FileExt.dll,7" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.avi\shell regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ogm\ = "mpcplayer.ogm" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.fli regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rtsp\ = "URL Protocol" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.rmvb\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FileExt.dll,8" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.ra\shell\open\command regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.amr\shell\open\command regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Software\RealNetworks\RealMediaSDK\6.0\Preferences\SuperBufferLength regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.rmvb\shell\open regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.amr\shell\open regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ts regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.d2v\shell regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.rpm\shell\open\command regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.smil\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FileExt.dll,8" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.ogm\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\MPCShell.exe\" \"%1\"" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rp\ = "mpcplayer.rp," regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.smi\shell regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.qt\DefaultIcon regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.m4p\shell regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.vp6\shell\open\ = "? ???? ??" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\Preferences\DT_Plugins\ = "C:\\Program Files (x86)\\Common Files\\Real\\Plugins\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\RealNetworks\RealPlayer\6.0\Preferences\Satellite4\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.ra\shell\open\ = "? ???? ??" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.d2v\shell\ = "Open" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.flc\shell\open\command regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VLC.tta\shell\MPCPlayer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.3g2\MPCPlayer = "VLC.3g2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.d2v\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FileExt.dll,10" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.swf regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.flc\DefaultIcon regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.ogm\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FileExt.dll,6" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.vob regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.vg2 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.ratDVD\ = "ratDVD ýÌåÎļþ" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.ratDVD\shell\open regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.roq regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Software\RealNetworks\RealPlayer\6.0\Preferences\Satellite15 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.3g2 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpcplayer.ts\shell\open\ = "? ???? ??" regsvr32.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2060 2248 regsvr32.exe 28 PID 2248 wrote to memory of 2060 2248 regsvr32.exe 28 PID 2248 wrote to memory of 2060 2248 regsvr32.exe 28 PID 2248 wrote to memory of 2060 2248 regsvr32.exe 28 PID 2248 wrote to memory of 2060 2248 regsvr32.exe 28 PID 2248 wrote to memory of 2060 2248 regsvr32.exe 28 PID 2248 wrote to memory of 2060 2248 regsvr32.exe 28 PID 2060 wrote to memory of 2036 2060 regsvr32.exe 30 PID 2060 wrote to memory of 2036 2060 regsvr32.exe 30 PID 2060 wrote to memory of 2036 2060 regsvr32.exe 30 PID 2060 wrote to memory of 2036 2060 regsvr32.exe 30 PID 2060 wrote to memory of 2036 2060 regsvr32.exe 30 PID 2060 wrote to memory of 2036 2060 regsvr32.exe 30 PID 2060 wrote to memory of 2036 2060 regsvr32.exe 30 PID 2060 wrote to memory of 1876 2060 regsvr32.exe 29 PID 2060 wrote to memory of 1876 2060 regsvr32.exe 29 PID 2060 wrote to memory of 1876 2060 regsvr32.exe 29 PID 2060 wrote to memory of 1876 2060 regsvr32.exe 29 PID 2060 wrote to memory of 1876 2060 regsvr32.exe 29 PID 2060 wrote to memory of 1876 2060 regsvr32.exe 29 PID 2060 wrote to memory of 1876 2060 regsvr32.exe 29 PID 2060 wrote to memory of 1668 2060 regsvr32.exe 32 PID 2060 wrote to memory of 1668 2060 regsvr32.exe 32 PID 2060 wrote to memory of 1668 2060 regsvr32.exe 32 PID 2060 wrote to memory of 1668 2060 regsvr32.exe 32 PID 2060 wrote to memory of 1668 2060 regsvr32.exe 32 PID 2060 wrote to memory of 1668 2060 regsvr32.exe 32 PID 2060 wrote to memory of 1668 2060 regsvr32.exe 32 PID 2060 wrote to memory of 1624 2060 regsvr32.exe 31 PID 2060 wrote to memory of 1624 2060 regsvr32.exe 31 PID 2060 wrote to memory of 1624 2060 regsvr32.exe 31 PID 2060 wrote to memory of 1624 2060 regsvr32.exe 31 PID 2060 wrote to memory of 1624 2060 regsvr32.exe 31 PID 2060 wrote to memory of 1624 2060 regsvr32.exe 31 PID 2060 wrote to memory of 1624 2060 regsvr32.exe 31
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\NEAS.f6fd6ad5f56bc6b669167d99cc480670_JC.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\NEAS.f6fd6ad5f56bc6b669167d99cc480670_JC.dll2⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Users\Admin\AppData\Local\Temp\Codecs\rat\TRLDRP6.ax3⤵PID:1876
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Users\Admin\AppData\Local\Temp\Codecs\rat\FCZip.dll3⤵PID:2036
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Users\Admin\AppData\Local\Temp\Codecs\rat\xebnav.ax3⤵PID:1624
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Users\Admin\AppData\Local\Temp\Codecs\rat\xebdec.ax3⤵PID:1668
-
-