109fc9126c9fe2676cdea8c24887efceb59fed728bc3881a7e7f40f634f0d9f4

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 21:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b837456f25af5d11664f9f3fb8881783.dll
Size

356KB
MD5

b837456f25af5d11664f9f3fb8881783
SHA1

a678ca4d7e4214fe6865a1d714c9b1fcae4c1863
SHA256

109fc9126c9fe2676cdea8c24887efceb59fed728bc3881a7e7f40f634f0d9f4
SHA512

f3b132956b301e273a970c5fafe5c6c5a910a599b5a06e9e9f5e6bc74550da627655f3599ff33a346854dd6135264b1ceb15fcfb422943585d9ad648120ab5a5
SSDEEP

6144:1RbgeNZuHrU9EgypahCcfX18qfCKUMXbH:UURCklJf1Um

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VAC.Video\ = "NewMediaCodec Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CDC0999C-999C-4EE1-875B-5C3542641768}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b837456f25af5d11664f9f3fb8881783.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B6A3935F-8FE4-49A4-B987-A1C09E53589F}\TypeLib\ = "{CDC0999C-999C-4EE1-875B-5C3542641768}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VAC.Video	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EF94A58F-599B-4602-9C34-99683C5859B1}\TypeLib\ = "{CDC0999C-999C-4EE1-875B-5C3542641768}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EF94A58F-599B-4602-9C34-99683C5859B1}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B6A3935F-8FE4-49A4-B987-A1C09E53589F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B6A3935F-8FE4-49A4-B987-A1C09E53589F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EF94A58F-599B-4602-9C34-99683C5859B1}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B6A3935F-8FE4-49A4-B987-A1C09E53589F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B6A3935F-8FE4-49A4-B987-A1C09E53589F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EF94A58F-599B-4602-9C34-99683C5859B1}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EF94A58F-599B-4602-9C34-99683C5859B1}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BABA5BDB-4EFF-48DB-B443-679651D37128}\ = "NewMediaCodec Property Page"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B6A3935F-8FE4-49A4-B987-A1C09E53589F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EF94A58F-599B-4602-9C34-99683C5859B1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EF94A58F-599B-4602-9C34-99683C5859B1}\ = "_DNewMediaCodecEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EF94A58F-599B-4602-9C34-99683C5859B1}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CDC0999C-999C-4EE1-875B-5C3542641768}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CDC0999C-999C-4EE1-875B-5C3542641768}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B6A3935F-8FE4-49A4-B987-A1C09E53589F}\ = "_DNewMediaCodec"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CDC0999C-999C-4EE1-875B-5C3542641768}\1.0\FLAGS\ = "2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\B83745~1.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B6A3935F-8FE4-49A4-B987-A1C09E53589F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\B83745~1.DLL, 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B6A3935F-8FE4-49A4-B987-A1C09E53589F}\TypeLib\ = "{CDC0999C-999C-4EE1-875B-5C3542641768}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VAC.Video\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}\ProgID\ = "VAC.Video"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B6A3935F-8FE4-49A4-B987-A1C09E53589F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CDC0999C-999C-4EE1-875B-5C3542641768}\1.0\ = "NewMediaCodec ActiveX Control module"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CDC0999C-999C-4EE1-875B-5C3542641768}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CDC0999C-999C-4EE1-875B-5C3542641768}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}\TypeLib\ = "{CDC0999C-999C-4EE1-875B-5C3542641768}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CDC0999C-999C-4EE1-875B-5C3542641768}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CDC0999C-999C-4EE1-875B-5C3542641768}\1.0\HELPDIR\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B6A3935F-8FE4-49A4-B987-A1C09E53589F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EF94A58F-599B-4602-9C34-99683C5859B1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EF94A58F-599B-4602-9C34-99683C5859B1}\ = "_DNewMediaCodecEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EF94A58F-599B-4602-9C34-99683C5859B1}\TypeLib\ = "{CDC0999C-999C-4EE1-875B-5C3542641768}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BABA5BDB-4EFF-48DB-B443-679651D37128}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}\MiscStatus\1\ = "132241"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CDC0999C-999C-4EE1-875B-5C3542641768}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B6A3935F-8FE4-49A4-B987-A1C09E53589F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B6A3935F-8FE4-49A4-B987-A1C09E53589F}\ = "_DNewMediaCodec"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B6A3935F-8FE4-49A4-B987-A1C09E53589F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BABA5BDB-4EFF-48DB-B443-679651D37128}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}\Control\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{150EA8E7-A97C-4816-AD02-4865EEF8C5FF}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EF94A58F-599B-4602-9C34-99683C5859B1}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BABA5BDB-4EFF-48DB-B443-679651D37128}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\B83745~1.DLL"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 1892	2992	regsvr32.exe	28
PID 2992 wrote to memory of 1892	2992	regsvr32.exe	28
PID 2992 wrote to memory of 1892	2992	regsvr32.exe	28
PID 2992 wrote to memory of 1892	2992	regsvr32.exe	28
PID 2992 wrote to memory of 1892	2992	regsvr32.exe	28
PID 2992 wrote to memory of 1892	2992	regsvr32.exe	28
PID 2992 wrote to memory of 1892	2992	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b837456f25af5d11664f9f3fb8881783.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b837456f25af5d11664f9f3fb8881783.dll
  2⤵
  - Modifies registry class
  PID:1892

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads