35bcbe83559ef07628aeb933f9c556b3a091ac996fb35508a482e3cd367d6a18

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shellMenu_gb.dll
Size 395KB
Sample240228-qlrayace5w
SHA256 14891303849d6eba437499540c2f1cb500702503d424fe534e07801ec71201df
MD5 fcc140a2ab2ba9d11191f4b512afbe2b
SHA1 e773565cc906bc7fc0f622dab4b7305260025582
SHA512 b2a6bdd71e3e2535fc6b73610d5623d3e60ca73a63aca44db4125369e0dee0421c1d3c3db65bed3d3491adf3fe64f31fd41566219a14823def5ad849d75e627c
SSDEEP 6144:WtP4Cmle6CnHM7OlrSWvdlfMooStLyrIesnYxVTuEhuleN7z7El:Y4Cml0nHWUffdHtLvY7TT3fW
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rmvb\shellex	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82FF2DC6-9723-484E-92B6-5717ADE25DE9}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shellex\ContextMenuHandlers\VideoConverter	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dat\shellex\ContextMenuHandlers\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rm\shellex\	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.mpeg\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.qt\shellex\ContextMenuHandlers\VideoConverter\ = "{82FF2DC6-9723-484E-92B6-5717ADE25DE9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpg\shellex	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\shellex\ContextMenuHandlers\VideoConverter	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rmvb\shellex\ContextMenuHandlers\VideoConverter\ = "{82FF2DC6-9723-484E-92B6-5717ADE25DE9}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.asf	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82FF2DC6-9723-484E-92B6-5717ADE25DE9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\shellMenu_gb.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shellex\ContextMenuHandlers	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg\ShellEx\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg\ShellEx\ContextMenuHandlers\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpg\shellex\ContextMenuHandlers\VideoConverter	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\ShellEx\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rmvb\shellex\ContextMenuHandlers\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shellex\ContextMenuHandlers\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shellex\ContextMenuHandlers\VideoConverter	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.asf\shellex	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg\ShellEx\ContextMenuHandlers\VideoConverter\ = "{82FF2DC6-9723-484E-92B6-5717ADE25DE9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dat	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dat\shellex\ContextMenuHandlers\VideoConverter	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.asf\ShellEx\ContextMenuHandlers\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shellex	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.mpeg	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.qt\shellex\ContextMenuHandlers\VideoConverter	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.mov	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\ShellEx\ContextMenuHandlers\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rm\shellex\ContextMenuHandlers\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rm\shellex\ContextMenuHandlers\VideoConverter\ = "{82FF2DC6-9723-484E-92B6-5717ADE25DE9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.asf\ShellEx\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg\shellex	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.mpg	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\shellex	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dat\shellex	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rm	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rm\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shellex\ContextMenuHandlers\VideoConverter\ = "{82FF2DC6-9723-484E-92B6-5717ADE25DE9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shellex\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rmvb\shellex\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.qt	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rm\shellex	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rmvb\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82FF2DC6-9723-484E-92B6-5717ADE25DE9}\ = "Context Menu Shell Extension"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shellex\ContextMenuHandlers\VideoConverter\ = "{82FF2DC6-9723-484E-92B6-5717ADE25DE9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.asf\ShellEx\ContextMenuHandlers\VideoConverter\ = "{82FF2DC6-9723-484E-92B6-5717ADE25DE9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82FF2DC6-9723-484E-92B6-5717ADE25DE9}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\.mov\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\ShellEx\ContextMenuHandlers\VideoConverter\ = "{82FF2DC6-9723-484E-92B6-5717ADE25DE9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dat\shellex\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rm\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rmvb	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpg\shellex\ContextMenuHandlers	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpg\ShellEx\ContextMenuHandlers\VideoConverter\ = "{82FF2DC6-9723-484E-92B6-5717ADE25DE9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shellex\ContextMenuHandlers	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shellex\ContextMenuHandlers\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dat\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rmvb\shellex\ContextMenuHandlers\VideoConverter	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 5028	3692	regsvr32.exe	96
PID 3692 wrote to memory of 5028	3692	regsvr32.exe	96
PID 3692 wrote to memory of 5028	3692	regsvr32.exe	96

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\shellMenu_gb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\shellMenu_gb.dll
  2⤵
  - Modifies registry class
  PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3816 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:1256

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads