e3bef3c169ed317c459bf9d52958a6ae4d4bf753ba6224ee4878e6bbddca067d | Triage

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 21:30

Sharing

Report Analysis Logs

General

Target

$R0.dll
Size

108KB
MD5

4e5ffc7e2d5b7147f9e39b557acc7ca8
SHA1

cfad21d197399fa3c7a31841785f1a0808d1d177
SHA256

071d3ebcfe5f39973684d31a2bf3f2f153fa99766a36a2a0aa42515bac8452f7
SHA512

792854e087f728de54f318e21d77195a7d5e2ebdf3c576b574cc574113105b400d57a29fec2f14d63dbed1b7bbd20d9bc07a076716770e01befa3fa3e815d783
SSDEEP

1536:3AgX9OSlN6dm7pEPX1EogO+TBPcfdaflWXyq:TX9saqaox9daflWXyq

Score

1^/10

Malware Config

Signatures

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1B10B71-F93D-4132-AFBA-8FF6E8F6DB5F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1B10B71-F93D-4132-AFBA-8FF6E8F6DB5F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1B10B71-F93D-4132-AFBA-8FF6E8F6DB5F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1B10B71-F93D-4132-AFBA-8FF6E8F6DB5F}\TypeLib\ = "{D6ADA718-47B3-4f04-BC12-ACC26E3282DB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1B10B71-F93D-4132-AFBA-8FF6E8F6DB5F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1B10B71-F93D-4132-AFBA-8FF6E8F6DB5F}\ = "WavePlug Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1B10B71-F93D-4132-AFBA-8FF6E8F6DB5F}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 1412	3884	regsvr32.exe	84
PID 3884 wrote to memory of 1412	3884	regsvr32.exe	84
PID 3884 wrote to memory of 1412	3884	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$R0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$R0.dll
  2⤵
  - Modifies registry class
  PID:1412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads