94fef3ee9512941ff1aa4c8a951598ae67c42b71fbc047d28f3164570497d0b0

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Filters/empgpdmx.dll
Size

848KB
MD5

a50fa651ff1c47528bd079ef4921fb03
SHA1

23a992c2e072488aa8eca45786463c3209d1c973
SHA256

a0518a8519337018fde863053b4a90c3245bb011ab6a16a851eb6d488d6c3bdb
SHA512

d544d91caa89e8d13245d9aa51e048fff6f94d330df7730d0487590d7160e69481dda75f3cedad955f3abdc8d253c7dd0253dc39c3af771c8f53ec0755693da9
SSDEEP

12288:FImQqiH9O/Avi4iiqHb33q3cuWixNKYsZKC0KxtNvZPd7s:emQqidAd4iiqHmcKNwZD0KxtNvtd7s

Score

1^/10

Malware Config

Signatures

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{668EE184-FD2D-4C72-8E79-439A35B438DE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\empgpdmx.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72F2EB40-0AE9-44EA-BEC9-25B664137C1B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72F2EB40-0AE9-44EA-BEC9-25B664137C1B}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Filter\{668EE184-FD2D-4C72-8E79-439A35B438DE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{668EE184-FD2D-4C72-8E79-439A35B438DE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EF2B187-6795-40C5-A3B5-E2292ADC24A1}\ = "Settings"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EF2B187-6795-40C5-A3B5-E2292ADC24A1}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{668EE184-FD2D-4C72-8E79-439A35B438DE}\CLSID = "{668EE184-FD2D-4C72-8E79-439A35B438DE}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{668EE184-FD2D-4C72-8E79-439A35B438DE}\FilterData = 020000000000200003000000000000003070693300000000000000000d000000000000000000000030747933000000008801000088010000317479330000000098010000a8010000327479330000000098010000b8010000337479330000000098010000c8010000347479330000000098010000d8010000357479330000000098010000e8010000367479330000000098010000f80100003774793300000000980100000802000038747933000000009801000018020000397479330000000098010000280200003a7479330000000098010000380200003b7479330000000098010000480200003c747933000000009801000058020000317069330d00000000000000040000000000000000000000307479330000000068020000e8010000317479330000000068020000d80100003274793300000000680200003802000033747933000000006802000058020000327069330d00000000000000020000000000000000000000307479330000000078020000c8010000317479330000000078020000480200000000000000000000000000000000000083eb36e44f52ce119f530020af0ba77084eb36e44f52ce119f530020af0ba77085eb36e44f52ce119f530020af0ba77086eb36e44f52ce119f530020af0ba77087eb36e44f52ce119f530020af0ba7705000000000001000800000aa00389b7122806de046dbcf11b4d100805f6cbbea23806de046dbcf11b4d100805f6cbbeaa4a98a13e21e5b4c988e19abfdbc8a1142b3aef42903dd4fa8fd4aff4926c9782b806de046dbcf11b4d100805f6cbbea26806de046dbcf11b4d100805f6cbbea2c806de046dbcf11b4d100805f6cbbea6175647300001000800000aa00389b717669647300001000800000aa00389b71	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Filter	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{668EE184-FD2D-4C72-8E79-439A35B438DE}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{668EE184-FD2D-4C72-8E79-439A35B438DE}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EF2B187-6795-40C5-A3B5-E2292ADC24A1}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EF2B187-6795-40C5-A3B5-E2292ADC24A1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\empgpdmx.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72F2EB40-0AE9-44EA-BEC9-25B664137C1B}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{668EE184-FD2D-4C72-8E79-439A35B438DE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{668EE184-FD2D-4C72-8E79-439A35B438DE}\ = "Elecard MPEG Push Demultiplexer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72F2EB40-0AE9-44EA-BEC9-25B664137C1B}\ = "About"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72F2EB40-0AE9-44EA-BEC9-25B664137C1B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\empgpdmx.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{668EE184-FD2D-4C72-8E79-439A35B438DE}\FriendlyName = "Elecard MPEG Push Demultiplexer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8EF2B187-6795-40C5-A3B5-E2292ADC24A1}	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2704	2744	regsvr32.exe	28
PID 2744 wrote to memory of 2704	2744	regsvr32.exe	28
PID 2744 wrote to memory of 2704	2744	regsvr32.exe	28
PID 2744 wrote to memory of 2704	2744	regsvr32.exe	28
PID 2744 wrote to memory of 2704	2744	regsvr32.exe	28
PID 2744 wrote to memory of 2704	2744	regsvr32.exe	28
PID 2744 wrote to memory of 2704	2744	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Filters\empgpdmx.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Filters\empgpdmx.dll
  2⤵
  - Modifies registry class
  PID:2704

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads