16a6baf82a2fb1c366cc6f94c382d55172e72855a5e435c898c6429aab2edd3c

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$COMMONFILES/PPLiveNetwork/player/CoreAAC.dll
Size 312KB
Sample240408-31hcssfg25
SHA256 04bf38bbd9cb8287582f9a2fb8b06e0ab30f06f676a93f4a56656b576f10e597
MD5 b0ffac757be8d6cc41e1131eb2b0d959
SHA1 0e41733a050bc2ed53fda6337d6501b9942317c2
SHA512 356ecf4902f767f74670e5fcd57f26fb8a43710d0a2b3a995877e6f265119b2f091c6e5e3457dfa1767c6e4043afc470cc7090f43dd997b27c0e94c7e102bee3
SSDEEP 6144:+yTbEUUmDAh189YEqbBpkJzJTba96sZTiaJfOMBfcESToVk:bxUmDAn4C9GBJba96sZTf9Oy+Wk
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4665E44B-8B9A-4515-A086-E94ECE374608}\ = "CoreAAC Audio Decoder About"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4665E44B-8B9A-4515-A086-E94ECE374608}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\FriendlyName = "CoreAAC Audio Decoder"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$COMMONFILES\\PPLiveNetwork\\player\\CoreAAC.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4665E44B-8B9A-4515-A086-E94ECE374608}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4665E44B-8B9A-4515-A086-E94ECE374608}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}\ = "CoreAAC Audio Decoder Info"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\ = "CoreAAC Audio Decoder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4665E44B-8B9A-4515-A086-E94ECE374608}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$COMMONFILES\\PPLiveNetwork\\player\\CoreAAC.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\CLSID = "{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\FilterData = 020000000000800002000000000000003070693300000000000000000200000000000000000000003074793300000000700000008000000031747933000000007000000090000000317069330800000000000000010000000000000000000000307479330000000070000000a00000006175647300001000800000aa00389b71ff00000000001000800000aa00389b714d50344100001000800000aa00389b710100000000001000800000aa00389b71	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$COMMONFILES\\PPLiveNetwork\\player\\CoreAAC.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 3044	2752	regsvr32.exe	28
PID 2752 wrote to memory of 3044	2752	regsvr32.exe	28
PID 2752 wrote to memory of 3044	2752	regsvr32.exe	28
PID 2752 wrote to memory of 3044	2752	regsvr32.exe	28
PID 2752 wrote to memory of 3044	2752	regsvr32.exe	28
PID 2752 wrote to memory of 3044	2752	regsvr32.exe	28
PID 2752 wrote to memory of 3044	2752	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\PPLiveNetwork\player\CoreAAC.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\PPLiveNetwork\player\CoreAAC.dll
  2⤵
  - Modifies registry class
  PID:3044

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads