7bdbc9c96d08ae37f7ec2845584727ee301a7a26d1bc03b015b52d5804caffbb

Analysis

max time kernel
139s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Plugin/ShellExt_x86.dll
Size

352KB
MD5

744cf96dbd2755c2d35ffb9585bf905a
SHA1

3acd2db4152d44e26341884786cfc44e00237ccb
SHA256

3a643bff2038e2b841f21264f152cab26f352d47f979f311853b975930250803
SHA512

c24aed66990d9ba63d51354374d6ed91787e7173e9ff25d548fcbeacd8918f3a606aac35c398f84f274e4aa338d49a2659a121fb7e269f0f17cb3f1c3581b3df
SSDEEP

6144:aUzrcRjZ7vtNL4166H3N0hEbUQU20KWZYpUa1ZxTBpGMWM0B4/K9uQ:jcRjZ7vtNL8qc0KWCUa9T/GMWZwK9uQ

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon\CurVer\ = "ShellExt.ShellIcon.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\ = "IShellApkInfo2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\TypeLib\ = "{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame\ShellEx\IconHandler	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plugin\\ShellExt_x86.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\NumMethods\ = "16"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame\ShellEx\IconHandler\ = "{7AF42AD7-2C1D-4CAD-B0EC-7BD8B5EE6346}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame\ShellEx\{00021500-0000-0000-C000-000000000046}\ = "{7AF42AD7-2C1D-4CAD-B0EC-7BD8B5EE6346}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\TypeLib\ = "{32fe7cb4-3936-41af-bf31-6f8fc8f86ac9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\ = "ShellExtLib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plugin\\ShellExt_x86.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plugin"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\ = "ShellIcon Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\ = "IShellApkInfo2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\TypeLib\ = "{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ = "PSFactoryBuffer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame\ShellEx	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon\ = "ShellIcon Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\ProxyStubClsid32\ = "{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame\ShellEx\{00021500-0000-0000-C000-000000000046}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon.1\ = "ShellIcon Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon.1\CLSID\ = "{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.apk\ = "apkfile_ldsgame"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plugin\\ShellExt_x86.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\TypeLib\ = "{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ProxyStubClsid32\ = "{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.apk	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\TypeLib\ = "{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\TypeLib	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3080 wrote to memory of 4996	3080	regsvr32.exe	regsvr32.exe
PID 3080 wrote to memory of 4996	3080	regsvr32.exe	regsvr32.exe
PID 3080 wrote to memory of 4996	3080	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Plugin\ShellExt_x86.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3080

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\Plugin\ShellExt_x86.dll
2⤵
- Modifies registry class
PID:4996

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads