94fef3ee9512941ff1aa4c8a951598ae67c42b71fbc047d28f3164570497d0b0

Analysis

max time kernel
139s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Filters/elaudec.dll
Size

789KB
MD5

65bc164691324846b73009b2343293a5
SHA1

b042beae9cc028a54145f0580ecd545138deee2e
SHA256

d8fa0b5f6b8be1fa99fda003963dd0d011ce41039b71286befbd9eac827b29be
SHA512

094403dfbef9a0273b34e480018bf1d1a640c865c543aec8c9abc8b411745d0ab3163d313e0a86fe099c53ea357f9328f3c3b31ceb3bb2aee2ee4dad9ffdc5cf
SSDEEP

12288:9hbEyqYmKRKO2i/yl7OVGCd9Oy7CpLZN61n:nEyqQgi/yNOVGC/7lR

Score

1^/10

Malware Config

Signatures

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}\ = "Settings"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\ = "Elecard Audio Decoder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\FriendlyName = "Elecard Audio Decoder"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\Options = ab8603071fafda0100000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\elaudec.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\elaudec.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}\ = "About"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\elaudec.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F6C4C97D-FBFF-433F-B099-B96A12D32391}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\CLSID = "{F6C4C97D-FBFF-433F-B099-B96A12D32391}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\FilterData = 0200000000000050020000000000000030706933000000000000000013000000000000000000000030747933000000008001000090010000317479330000000080010000a0010000327479330000000080010000b00100003374793300000000c0010000b00100003474793300000000d0010000b0010000357479330000000080010000e0010000367479330000000080010000f00100003774793300000000800100000002000038747933000000008001000010020000397479330000000080010000200200003a7479330000000080010000300200003b74793300000000d0010000200200003c7479330000000040020000f00100003d7479330000000080010000500200003e7479330000000080010000600200003f74793300000000d001000060020000407479330000000080010000700200004174793300000000800100008002000042747933000000008001000090020000317069330800000000000000010000000000000000000000307479330000000080010000a00100006175647300001000800000aa00389b71000000000000000000000000000000000100000000001000800000aa00389b712c806de046dbcf11b4d100805f6cbbea6a910bed4d04d111aa7800c04fc31d6020806de046dbcf11b4d100805f6cbbea0020000000001000800000aa00389b7187eb36e44f52ce119f530020af0ba77080eb36e44f52ce119f530020af0ba77081eb36e44f52ce119f530020af0ba7705000000000001000800000aa00389b712b806de046dbcf11b4d100805f6cbbea83eb36e44f52ce119f530020af0ba7705500000000001000800000aa00389b7132806de046dbcf11b4d100805f6cbbeaff00000000001000800000aa00389b717802000000001000800000aa00389b714d50344100001000800000aa00389b71	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 4020	4024	regsvr32.exe	90
PID 4024 wrote to memory of 4020	4024	regsvr32.exe	90
PID 4024 wrote to memory of 4020	4024	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Filters\elaudec.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Filters\elaudec.dll
  2⤵
  - Modifies registry class
  PID:4020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2164

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads