e7e50678a688b5a7bd3b76ca1e948809590ebff535881f9d245dafbfb8b3dc11 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 13:44

Sharing

Report Analysis Logs

General

Target

asyncflt.dll
Size

52KB
MD5

5445da4d5b8f345ce027b76a534ab5c5
SHA1

d2961815278d87b229cfe28cadaf3095b37da14d
SHA256

99413bbc40252370d75f087b203d6945846602e54c5ca29f642324f19513a374
SHA512

68550e861feae8b6390efe50fc290ef6dc39e1ee75007e01ee07a2fbd9de7d41fbcc0909c4a17303fa83b41a7dc566de85a1882d8d515fa9751ef0adeb71cee2
SSDEEP

768:cYEc7vXK64uE6mwUkoBeyH3OhbYffB4hv+d6VAM:cYb7va69E/5LelYfSho6Vl

Score

1^/10

Malware Config

Signatures

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vjvod	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vjvod\Source Filter = "{D9845282-F694-4bbc-89B1-708619FE53D9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9845282-F694-4BBC-89B1-708619FE53D9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9845282-F694-4BBC-89B1-708619FE53D9}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D9845282-F694-4BBC-89B1-708619FE53D9}\FriendlyName = "VJVod Source Filter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D9845282-F694-4BBC-89B1-708619FE53D9}\CLSID = "{D9845282-F694-4BBC-89B1-708619FE53D9}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D9845282-F694-4BBC-89B1-708619FE53D9}\FilterData = 020000000000400001000000000000003070693308000000000000000100000000000000000000003074793300000000380000004800000083eb36e44f52ce119f530020af0ba77000000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9845282-F694-4BBC-89B1-708619FE53D9}\ = "VJVod Source Filter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9845282-F694-4BBC-89B1-708619FE53D9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\asyncflt.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9845282-F694-4BBC-89B1-708619FE53D9}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D9845282-F694-4BBC-89B1-708619FE53D9}	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 856	1796	regsvr32.exe	28
PID 1796 wrote to memory of 856	1796	regsvr32.exe	28
PID 1796 wrote to memory of 856	1796	regsvr32.exe	28
PID 1796 wrote to memory of 856	1796	regsvr32.exe	28
PID 1796 wrote to memory of 856	1796	regsvr32.exe	28
PID 1796 wrote to memory of 856	1796	regsvr32.exe	28
PID 1796 wrote to memory of 856	1796	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\asyncflt.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\asyncflt.dll
  2⤵
  - Modifies registry class
  PID:856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads