f166ff7bf5585d3cff368be6a5a51673c57bb24df6c555619ee3e90c7f066a3d

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2024, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$SYSDIR/forcetv.dll
Size 440KB
Sample240304-hll28acd21
SHA256 0da38fd942c81a0f12c4b7cb6eafa6d664e6d314455e02500a0a10c2459d4498
MD5 9de90e605c862a5d5cd6aaf3294e4c31
SHA1 67ef6f2147ed83d0e7f6ee384835f6c8cd4801b2
SHA512 cf442a7ae10675a983517f4fe96e708b18b442b805bfcd1624f5764a63460bf70aeafe6c7659b7ce74cd3bc28300ba7350b128288ac1f28f03270b409bdec278
SSDEEP 6144:MKQ9gl1VQYkve1TsLPrgfYQcbQsSyu1qf/N/CDJyen+tahFNN8gMbjBeeeeeeee3:wCQY8cygxd4/NsJo1j
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3738E105-064B-4EB0-A1AB-0CE0E1881EA6}\TypeLib\ = "{EFB38046-007E-43CC-8BE0-73EB4ABE80D2}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3738E105-064B-4EB0-A1AB-0CE0E1881EA6}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mediaplay.PPMediaCtrl\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{528FF3A9-3854-461A-9362-F4D22BDF1A94}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\TypeLib\ = "{EFB38046-007E-43CC-8BE0-73EB4ABE80D2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFB38046-007E-43CC-8BE0-73EB4ABE80D2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{528FF3A9-3854-461A-9362-F4D22BDF1A94}\ = "_IPPMediaCtrlEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mediaplay.PPMediaCtrl\CLSID\ = "{FCD61199-E187-4ADD-88E5-9AF238486D11}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\VersionIndependentProgID\ = "mediaplay.PPMediaCtrl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFB38046-007E-43CC-8BE0-73EB4ABE80D2}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFB38046-007E-43CC-8BE0-73EB4ABE80D2}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3738E105-064B-4EB0-A1AB-0CE0E1881EA6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mediaplay.PPMediaCtrl.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFB38046-007E-43CC-8BE0-73EB4ABE80D2}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3738E105-064B-4EB0-A1AB-0CE0E1881EA6}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\InprocServer32\ThreadingModel = "apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFB38046-007E-43CC-8BE0-73EB4ABE80D2}\1.0\ = "mediaplay 1.0 ÀàÐÍ¿â"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mediaplay.PPMediaCtrl\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3738E105-064B-4EB0-A1AB-0CE0E1881EA6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3738E105-064B-4EB0-A1AB-0CE0E1881EA6}\ = "IPPMediaCtrl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mediaplay.PPMediaCtrl.1\CLSID\ = "{FCD61199-E187-4ADD-88E5-9AF238486D11}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mediaplay.PPMediaCtrl	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFB38046-007E-43CC-8BE0-73EB4ABE80D2}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{528FF3A9-3854-461A-9362-F4D22BDF1A94}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3738E105-064B-4EB0-A1AB-0CE0E1881EA6}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3738E105-064B-4EB0-A1AB-0CE0E1881EA6}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\forcetv.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\ProgID\ = "mediaplay.PPMediaCtrl.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{528FF3A9-3854-461A-9362-F4D22BDF1A94}\ = "_IPPMediaCtrlEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFB38046-007E-43CC-8BE0-73EB4ABE80D2}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{528FF3A9-3854-461A-9362-F4D22BDF1A94}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{528FF3A9-3854-461A-9362-F4D22BDF1A94}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{528FF3A9-3854-461A-9362-F4D22BDF1A94}\TypeLib\ = "{EFB38046-007E-43CC-8BE0-73EB4ABE80D2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mediaplay.PPMediaCtrl.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{528FF3A9-3854-461A-9362-F4D22BDF1A94}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mediaplay.PPMediaCtrl\CurVer\ = "mediaplay.PPMediaCtrl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3738E105-064B-4EB0-A1AB-0CE0E1881EA6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{528FF3A9-3854-461A-9362-F4D22BDF1A94}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3738E105-064B-4EB0-A1AB-0CE0E1881EA6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFB38046-007E-43CC-8BE0-73EB4ABE80D2}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\forcetv.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFB38046-007E-43CC-8BE0-73EB4ABE80D2}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{528FF3A9-3854-461A-9362-F4D22BDF1A94}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\forcetv.dll, 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\MiscStatus\1\ = "131473"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3738E105-064B-4EB0-A1AB-0CE0E1881EA6}\ = "IPPMediaCtrl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3738E105-064B-4EB0-A1AB-0CE0E1881EA6}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mediaplay.PPMediaCtrl\ = "CPPMediaCtrl Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{528FF3A9-3854-461A-9362-F4D22BDF1A94}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{528FF3A9-3854-461A-9362-F4D22BDF1A94}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCD61199-E187-4ADD-88E5-9AF238486D11}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EFB38046-007E-43CC-8BE0-73EB4ABE80D2}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{528FF3A9-3854-461A-9362-F4D22BDF1A94}\TypeLib\ = "{EFB38046-007E-43CC-8BE0-73EB4ABE80D2}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 3792	4628	regsvr32.exe	95
PID 4628 wrote to memory of 3792	4628	regsvr32.exe	95
PID 4628 wrote to memory of 3792	4628	regsvr32.exe	95

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\forcetv.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\forcetv.dll
  2⤵
  - Modifies registry class
  PID:3792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3928 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:1288

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads