94fef3ee9512941ff1aa4c8a951598ae67c42b71fbc047d28f3164570497d0b0

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Filters/elaudec.dll
Size

789KB
MD5

65bc164691324846b73009b2343293a5
SHA1

b042beae9cc028a54145f0580ecd545138deee2e
SHA256

d8fa0b5f6b8be1fa99fda003963dd0d011ce41039b71286befbd9eac827b29be
SHA512

094403dfbef9a0273b34e480018bf1d1a640c865c543aec8c9abc8b411745d0ab3163d313e0a86fe099c53ea357f9328f3c3b31ceb3bb2aee2ee4dad9ffdc5cf
SSDEEP

12288:9hbEyqYmKRKO2i/yl7OVGCd9Oy7CpLZN61n:nEyqQgi/yNOVGC/7lR

Score

1^/10

Malware Config

Signatures

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\ = "Elecard Audio Decoder"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}\ = "About"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\elaudec.dll"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\Options = e0233bf81eafda0100000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F6C4C97D-FBFF-433F-B099-B96A12D32391}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\elaudec.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\FriendlyName = "Elecard Audio Decoder"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\FilterData = 0200000000000050020000000000000030706933000000000000000013000000000000000000000030747933000000008001000090010000317479330000000080010000a0010000327479330000000080010000b00100003374793300000000c0010000b00100003474793300000000d0010000b0010000357479330000000080010000e0010000367479330000000080010000f00100003774793300000000800100000002000038747933000000008001000010020000397479330000000080010000200200003a7479330000000080010000300200003b74793300000000d0010000200200003c7479330000000040020000f00100003d7479330000000080010000500200003e7479330000000080010000600200003f74793300000000d001000060020000407479330000000080010000700200004174793300000000800100008002000042747933000000008001000090020000317069330800000000000000010000000000000000000000307479330000000080010000a00100006175647300001000800000aa00389b71000000000000000000000000000000000100000000001000800000aa00389b712c806de046dbcf11b4d100805f6cbbea6a910bed4d04d111aa7800c04fc31d6020806de046dbcf11b4d100805f6cbbea0020000000001000800000aa00389b7187eb36e44f52ce119f530020af0ba77080eb36e44f52ce119f530020af0ba77081eb36e44f52ce119f530020af0ba7705000000000001000800000aa00389b712b806de046dbcf11b4d100805f6cbbea83eb36e44f52ce119f530020af0ba7705500000000001000800000aa00389b7132806de046dbcf11b4d100805f6cbbeaff00000000001000800000aa00389b717802000000001000800000aa00389b714d50344100001000800000aa00389b71	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\elaudec.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}\ = "Settings"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\CLSID = "{F6C4C97D-FBFF-433F-B099-B96A12D32391}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2820	2908	regsvr32.exe	28
PID 2908 wrote to memory of 2820	2908	regsvr32.exe	28
PID 2908 wrote to memory of 2820	2908	regsvr32.exe	28
PID 2908 wrote to memory of 2820	2908	regsvr32.exe	28
PID 2908 wrote to memory of 2820	2908	regsvr32.exe	28
PID 2908 wrote to memory of 2820	2908	regsvr32.exe	28
PID 2908 wrote to memory of 2820	2908	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Filters\elaudec.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Filters\elaudec.dll
  2⤵
  - Modifies registry class
  PID:2820

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads