e67777b181a1ca1f21890bd0da9b177bcd850498375af8f1b0d3d61c7a54c9d0

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/MP4Splitter.dll
Size

509KB
MD5

bb01bfdc1bfe48cf9c18180bf6539917
SHA1

25d0a11d31857fef74e9b98dcabd96f24d89c774
SHA256

050649bb8dc43e68753de7567e17972cbcec1a2dacf243befeb12dc51517f7cc
SHA512

f4fa00923ee61f0fcb53c8ebfd65b27db54a7663e5d60d8a56f7d08f33e2e1c467aa0b58899fbd62ac2261b185655cc94bac9ce85e2ed3b0c32336daa5346ba5
SSDEEP

12288:TwQ9eDwtt/jTdrBGg93e19FJdQXajEEWq7uTj6T9:0Q9eDwtZTdr47QXFJ9Tjc9

Score

1^/10

Malware Config

Signatures

Modifies registry class 44 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{08E22ADA-B715-45ED-9D20-7B87750301D4}\3 = "4,4,,736b6970"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3D9D58B-45B5-48AB-B199-B8C40560AEC7}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$PLUGINSDIR\\MP4Splitter.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}\CLSID = "{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}\FriendlyName = "MPC - MP4 Source"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}\FilterData = 02000000000060000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}\CLSID = "{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{08E22ADA-B715-45ED-9D20-7B87750301D4}\2 = "4,4,,6d646174"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{08E22ADA-B715-45ED-9D20-7B87750301D4}\Source Filter = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$PLUGINSDIR\\MP4Splitter.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3D9D58B-45B5-48AB-B199-B8C40560AEC7}\ = "MPC - MPEG4 Video Splitter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}\ = "MPC - MPEG4 Video Source"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{08E22ADA-B715-45ED-9D20-7B87750301D4}\4 = "4,12,ffffffff00000000ffffffff,77696465027fe3706d646174"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}\ = "MPC - MP4 Splitter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}\ = "MPC - MP4 Source"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}\CLSID = "{3CCC052E-BDEE-408A-BEA7-90914EF2964B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D3D9D58B-45B5-48AB-B199-B8C40560AEC7}\CLSID = "{D3D9D58B-45B5-48AB-B199-B8C40560AEC7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{08E22ADA-B715-45ED-9D20-7B87750301D4}\0 = "4,4,,66747970"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{08E22ADA-B715-45ED-9D20-7B87750301D4}\5 = "3,3,,000001"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$PLUGINSDIR\\MP4Splitter.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D3D9D58B-45B5-48AB-B199-B8C40560AEC7}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D3D9D58B-45B5-48AB-B199-B8C40560AEC7}\FilterData = 02000000000060000200000000000000307069330000000000000000020000000000000000000000307479330000000060000000700000003174793300000000600000008000000031706933080000000000000000000000000000000000000083eb36e44f52ce119f530020af0ba770da2ae20815b7ed459d207b87750301d400000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{08E22ADA-B715-45ED-9D20-7B87750301D4}\1 = "4,4,,6d6f6f76"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}\FriendlyName = "MPC - MP4 Splitter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{08E22ADA-B715-45ED-9D20-7B87750301D4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3D9D58B-45B5-48AB-B199-B8C40560AEC7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$PLUGINSDIR\\MP4Splitter.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3D9D58B-45B5-48AB-B199-B8C40560AEC7}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}\FilterData = 02000000000060000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D3D9D58B-45B5-48AB-B199-B8C40560AEC7}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}\FilterData = 02000000000060000200000000000000307069330000000000000000020000000000000000000000307479330000000060000000700000003174793300000000600000008000000031706933080000000000000000000000000000000000000083eb36e44f52ce119f530020af0ba770da2ae20815b7ed459d207b87750301d400000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D3D9D58B-45B5-48AB-B199-B8C40560AEC7}\FriendlyName = "MPC - MPEG4 Video Splitter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}\FriendlyName = "MPC - MPEG4 Video Source"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2856	2464	regsvr32.exe	28
PID 2464 wrote to memory of 2856	2464	regsvr32.exe	28
PID 2464 wrote to memory of 2856	2464	regsvr32.exe	28
PID 2464 wrote to memory of 2856	2464	regsvr32.exe	28
PID 2464 wrote to memory of 2856	2464	regsvr32.exe	28
PID 2464 wrote to memory of 2856	2464	regsvr32.exe	28
PID 2464 wrote to memory of 2856	2464	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MP4Splitter.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MP4Splitter.dll
  2⤵
  - Modifies registry class
  PID:2856

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads