94fef3ee9512941ff1aa4c8a951598ae67c42b71fbc047d28f3164570497d0b0

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Filters/thsource.dll
Size

280KB
MD5

e59e5822fd0b9a8ea17fd65a1947cc42
SHA1

e4ab66143da290658c7c3b37cb00ae5000e1e0eb
SHA256

521027a8c714dab4e0827e1fd8862665b31c7b119ab5d974cf4e4b845f3b8756
SHA512

8c0bf6c40981543dacb5ba8cd63551b6441d66343f482df7b8ce5133a6918b553dc69332f18039e0fd2db92992dd91c8280d2d458621d37e5a2bd062b715c1af
SSDEEP

6144:4dyQLQB9L/vMGS7krt3DAB0KEE6QBLOkcEtmnnkBhNlHe0d31yfQoxQaxQJ:QFQBx/omt3DAB0KBNlH

Score

1^/10

Malware Config

Signatures

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB21DC73-9CBA-4D5E-918F-8E85192B3B28}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{7CDF271B-B889-4CFB-9F61-9D5E7C180894}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{7CDF271B-B889-4CFB-9F61-9D5E7C180894}\CLSID = "{7CDF271B-B889-4CFB-9F61-9D5E7C180894}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB21DC73-9CBA-4D5E-918F-8E85192B3B28}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\thsource.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3CE012F3-6A39-4747-B125-C3F095F247CA}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{7CDF271B-B889-4CFB-9F61-9D5E7C180894}\FriendlyName = "DVB Source"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CDF271B-B889-4CFB-9F61-9D5E7C180894}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CDF271B-B889-4CFB-9F61-9D5E7C180894}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB21DC73-9CBA-4D5E-918F-8E85192B3B28}\ = "DVB Source Property Page"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{7CDF271B-B889-4CFB-9F61-9D5E7C180894}\FilterData = 020000000000200004000000000000003070693308000000000000000100000000000000000000003074793300000000b0000000c00000003170693308000000000000000100000000000000000000003074793300000000b0000000d00000003270693308000000000000000100000000000000000000003074793300000000e0000000c00000003370693308000000000000000100000000000000000000003074793300000000c0000000c000000083eb36e44f52ce119f530020af0ba7700000000000000000000000000000000023806de046dbcf11b4d100805f6cbbea7669647300001000800000aa00389b71	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB21DC73-9CBA-4D5E-918F-8E85192B3B28}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3CE012F3-6A39-4747-B125-C3F095F247CA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3CE012F3-6A39-4747-B125-C3F095F247CA}\ = "DVB Pid Filter Property Page"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB21DC73-9CBA-4D5E-918F-8E85192B3B28}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3CE012F3-6A39-4747-B125-C3F095F247CA}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3CE012F3-6A39-4747-B125-C3F095F247CA}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\thsource.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CDF271B-B889-4CFB-9F61-9D5E7C180894}\ = "DVB Source"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CDF271B-B889-4CFB-9F61-9D5E7C180894}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\thsource.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CDF271B-B889-4CFB-9F61-9D5E7C180894}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 1332	2936	regsvr32.exe	29
PID 2936 wrote to memory of 1332	2936	regsvr32.exe	29
PID 2936 wrote to memory of 1332	2936	regsvr32.exe	29
PID 2936 wrote to memory of 1332	2936	regsvr32.exe	29
PID 2936 wrote to memory of 1332	2936	regsvr32.exe	29
PID 2936 wrote to memory of 1332	2936	regsvr32.exe	29
PID 2936 wrote to memory of 1332	2936	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Filters\thsource.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Filters\thsource.dll
  2⤵
  - Modifies registry class
  PID:1332

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads