94fef3ee9512941ff1aa4c8a951598ae67c42b71fbc047d28f3164570497d0b0 | Triage

Analysis

max time kernel
129s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 03:43

Sharing

Report Analysis Logs

General

Target

Filters/LC.dll
Size

76KB
MD5

6316c4082cacf8f3f4f22daef56cb15c
SHA1

cea3de90b20396b092797ec8c7e241e822c8faed
SHA256

5594b08c79a4d188a674713011cd516618fa36d2f988f7d353fb3370939a4062
SHA512

e1e0a6440f91b208b61775e30d8fc1be299a298e00ed564ca7c74fa8728738af66e6c3c0805553abbc4a8d2838cd21bfde61ac2322fff4e62ac4d6796a0821bc
SSDEEP

1536:amAnsoKlNNzfkEMqqU+2bbbAV2/S2eVLVUJfKFjJ:aooKlNNQEMqqDL2/MJUJfKFjJ

Score

1^/10

Malware Config

Signatures

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C10075-CA5C-4EDE-A033-AD28827A2F66}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\LC.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C10075-CA5C-4EDE-A033-AD28827A2F66}\InprocServer32\ThreadingModel = "both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13DEF622-983C-4FA4-91CD-238C72DE4F3F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\LC.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13DEF622-983C-4FA4-91CD-238C72DE4F3F}\InprocServer32\ThreadingModel = "both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C10075-CA5C-4EDE-A033-AD28827A2F66}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C10075-CA5C-4EDE-A033-AD28827A2F66}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C10075-CA5C-4EDE-A033-AD28827A2F66}\ = "Elecard LC"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13DEF622-983C-4FA4-91CD-238C72DE4F3F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13DEF622-983C-4FA4-91CD-238C72DE4F3F}\ = "Elecard LC"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13DEF622-983C-4FA4-91CD-238C72DE4F3F}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 4992	2372	regsvr32.exe	85
PID 2372 wrote to memory of 4992	2372	regsvr32.exe	85
PID 2372 wrote to memory of 4992	2372	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Filters\LC.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Filters\LC.dll
  2⤵
  - Modifies registry class
  PID:4992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads