3a84dcd785951a77e55dce913cf87596cf0c635beebbde11c8eb79f31eb809ef

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 09:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

76f81aeecc7dc52bf87936c2503964c8.dll
Size

127KB
MD5

76f81aeecc7dc52bf87936c2503964c8
SHA1

5b56605ff815886e6b8b2e51f0f48de43cd3ee4e
SHA256

3a84dcd785951a77e55dce913cf87596cf0c635beebbde11c8eb79f31eb809ef
SHA512

f13295ab54100218a31700da1cdafa9527326e43731c7a4229eb07cc039095bade916070ab825982b243e127db65b336916e36a8ffa014960ba4f29cd4c15435
SSDEEP

3072:NIKZxr1TyM+HXN08ksRbrZPqy4j12qQ6UK5wMJiEve:r/rEMmNlTb1t4jgq9BwYiE2

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A6F28C61-CCC2-4FF6-BB94-B360655C6671}\ = "_Dcodec_klass"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AF922752-14A4-4196-BACA-14820ED81DB5}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AMXCodec.AMXCodecCtrl.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D7CBFB8-F71C-4537-932F-17C07215F0DD}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AMXCodec.AMXCodecCtrl.1\CLSID\ = "{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D7CBFB8-F71C-4537-932F-17C07215F0DD}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\76f81aeecc7dc52bf87936c2503964c8.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6F28C61-CCC2-4FF6-BB94-B360655C6671}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D7CBFB8-F71C-4537-932F-17C07215F0DD}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6F28C61-CCC2-4FF6-BB94-B360655C6671}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AF922752-14A4-4196-BACA-14820ED81DB5}\TypeLib\ = "{4D7CBFB8-F71C-4537-932F-17C07215F0DD}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\Control\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D7CBFB8-F71C-4537-932F-17C07215F0DD}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AMXCodec.AMXCodecCtrl.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\MiscStatus\1\ = "131473"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A6F28C61-CCC2-4FF6-BB94-B360655C6671}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A6F28C61-CCC2-4FF6-BB94-B360655C6671}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF922752-14A4-4196-BACA-14820ED81DB5}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AMXCodec.AMXCodecCtrl.1\ = "AMXCodec Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D7CBFB8-F71C-4537-932F-17C07215F0DD}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF922752-14A4-4196-BACA-14820ED81DB5}\ = "_Dcodec_klassEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B76C8F2-AD03-4BC8-8A13-B051D5A96AE3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\ProgID\ = "AMXCodec.AMXCodecCtrl.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\76F81A~1.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6F28C61-CCC2-4FF6-BB94-B360655C6671}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D7CBFB8-F71C-4537-932F-17C07215F0DD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF922752-14A4-4196-BACA-14820ED81DB5}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF922752-14A4-4196-BACA-14820ED81DB5}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D7CBFB8-F71C-4537-932F-17C07215F0DD}\1.0\FLAGS\ = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF922752-14A4-4196-BACA-14820ED81DB5}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF922752-14A4-4196-BACA-14820ED81DB5}\TypeLib\ = "{4D7CBFB8-F71C-4537-932F-17C07215F0DD}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B76C8F2-AD03-4BC8-8A13-B051D5A96AE3}\ = "AMXCodec Property Page"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D7CBFB8-F71C-4537-932F-17C07215F0DD}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AF922752-14A4-4196-BACA-14820ED81DB5}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A6F28C61-CCC2-4FF6-BB94-B360655C6671}\TypeLib\ = "{4D7CBFB8-F71C-4537-932F-17C07215F0DD}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6F28C61-CCC2-4FF6-BB94-B360655C6671}\TypeLib\ = "{4D7CBFB8-F71C-4537-932F-17C07215F0DD}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\ = "AMXCodec Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\76F81A~1.DLL, 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\TypeLib\ = "{4D7CBFB8-F71C-4537-932F-17C07215F0DD}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4D7CBFB8-F71C-4537-932F-17C07215F0DD}\1.0\ = "codec_klass ActiveX Control module"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AF922752-14A4-4196-BACA-14820ED81DB5}\ = "_Dcodec_klassEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF922752-14A4-4196-BACA-14820ED81DB5}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF57FCBD-1331-4C45-B6B9-8337F0C8A100}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A6F28C61-CCC2-4FF6-BB94-B360655C6671}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6F28C61-CCC2-4FF6-BB94-B360655C6671}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6F28C61-CCC2-4FF6-BB94-B360655C6671}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AF922752-14A4-4196-BACA-14820ED81DB5}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AF922752-14A4-4196-BACA-14820ED81DB5}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B76C8F2-AD03-4BC8-8A13-B051D5A96AE3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\76F81A~1.DLL"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2216	2228	regsvr32.exe	16
PID 2228 wrote to memory of 2216	2228	regsvr32.exe	16
PID 2228 wrote to memory of 2216	2228	regsvr32.exe	16
PID 2228 wrote to memory of 2216	2228	regsvr32.exe	16
PID 2228 wrote to memory of 2216	2228	regsvr32.exe	16
PID 2228 wrote to memory of 2216	2228	regsvr32.exe	16
PID 2228 wrote to memory of 2216	2228	regsvr32.exe	16

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\76f81aeecc7dc52bf87936c2503964c8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\76f81aeecc7dc52bf87936c2503964c8.dll
  2⤵
  - Modifies registry class
  PID:2216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2216-0-0x0000000010000000-0x0000000010053000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads