e67777b181a1ca1f21890bd0da9b177bcd850498375af8f1b0d3d61c7a54c9d0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/OPlayer.dll
Size

1.2MB
MD5

ca3028a6adee108bb3fd4657e9632355
SHA1

43be6285c5f7ed07062dce2f23171b7965147f98
SHA256

57ee68455ef1219b05d8efea12beeba73a1ef03608756e693706b5096c2a558f
SHA512

47461d1797170e62fcb5170f22b859046dc09541614044a29c8c56377ffa30780dc8e1210b6a2600232f1e3fd68c26493e47d6b90367acf8396b430f7092e601
SSDEEP

24576:nYwfR3koBM2m5FoxgQ+esJjuGOYI9j7MgjZhm9xHyxrRa/J7I7w8+6aQ20it7:ndkLzJCGOYI9j7Mg9hmz2rRa/FI7w30U

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98F7345A-794A-4CE9-A1F6-F02AF3896E65}\1.0\ = "splayer 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A30BDD15-203E-41B1-8896-A13B389DEBCE}\TypeLib\ = "{98F7345A-794A-4CE9-A1F6-F02AF3896E65}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03CFFB0B-98E4-4BB3-B764-5DD3D4B28878}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03CFFB0B-98E4-4BB3-B764-5DD3D4B28878}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C180C13-3D60-425F-A554-8AE406D6447A}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ppl\Extensions\.mp4 = "{8c180c13-3d60-425f-a554-8ae406d6447a}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}\VersionIndependentProgID\ = "splayer.SPlayer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57D9A92E-7A5C-4119-9AA9-475ADE95474F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ppl	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\splayer.SPlayer.1\ = "SPlayer Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ppl\ = "PPLive Media Server"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\splayer.SPlayer\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98F7345A-794A-4CE9-A1F6-F02AF3896E65}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98F7345A-794A-4CE9-A1F6-F02AF3896E65}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$PLUGINSDIR"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{03CFFB0B-98E4-4BB3-B764-5DD3D4B28878}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03CFFB0B-98E4-4BB3-B764-5DD3D4B28878}\TypeLib\ = "{98F7345A-794A-4CE9-A1F6-F02AF3896E65}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A30BDD15-203E-41B1-8896-A13B389DEBCE}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{57D9A92E-7A5C-4119-9AA9-475ADE95474F}\TypeLib\ = "{98F7345A-794A-4CE9-A1F6-F02AF3896E65}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C180C13-3D60-425F-A554-8AE406D6447A}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E4C918DF-A6FD-4D0B-BC5C-F670439F22CD}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E4C918DF-A6FD-4D0B-BC5C-F670439F22CD}\FilterData = 02000000000020000100000000000000307069330800000000000000000000000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\splayer.SPlayer\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$PLUGINSDIR\\OPlayer.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A30BDD15-203E-41B1-8896-A13B389DEBCE}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03CFFB0B-98E4-4BB3-B764-5DD3D4B28878}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A30BDD15-203E-41B1-8896-A13B389DEBCE}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A30BDD15-203E-41B1-8896-A13B389DEBCE}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57D9A92E-7A5C-4119-9AA9-475ADE95474F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57D9A92E-7A5C-4119-9AA9-475ADE95474F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E4C918DF-A6FD-4D0B-BC5C-F670439F22CD}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A30BDD15-203E-41B1-8896-A13B389DEBCE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A30BDD15-203E-41B1-8896-A13B389DEBCE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{57D9A92E-7A5C-4119-9AA9-475ADE95474F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ppl\Extensions	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98F7345A-794A-4CE9-A1F6-F02AF3896E65}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A30BDD15-203E-41B1-8896-A13B389DEBCE}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57D9A92E-7A5C-4119-9AA9-475ADE95474F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E4C918DF-A6FD-4D0B-BC5C-F670439F22CD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A30BDD15-203E-41B1-8896-A13B389DEBCE}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C180C13-3D60-425F-A554-8AE406D6447A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$PLUGINSDIR\\OPlayer.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{8C180C13-3D60-425F-A554-8AE406D6447A}\FriendlyName = "PPLive PPLMpeg4 Splitter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\splayer.SPlayer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}\ = "SPlayer Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}\TypeLib\ = "{98F7345A-794A-4CE9-A1F6-F02AF3896E65}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98F7345A-794A-4CE9-A1F6-F02AF3896E65}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8C180C13-3D60-425F-A554-8AE406D6447A}\ = "PPLive PPLMpeg4 Splitter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{57D9A92E-7A5C-4119-9AA9-475ADE95474F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98F7345A-794A-4CE9-A1F6-F02AF3896E65}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98F7345A-794A-4CE9-A1F6-F02AF3896E65}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$PLUGINSDIR\\OPlayer.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{03CFFB0B-98E4-4BB3-B764-5DD3D4B28878}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03CFFB0B-98E4-4BB3-B764-5DD3D4B28878}\ = "_ISPlayerEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{57D9A92E-7A5C-4119-9AA9-475ADE95474F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\splayer.SPlayer.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{03CFFB0B-98E4-4BB3-B764-5DD3D4B28878}\TypeLib\ = "{98F7345A-794A-4CE9-A1F6-F02AF3896E65}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{03CFFB0B-98E4-4BB3-B764-5DD3D4B28878}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57D9A92E-7A5C-4119-9AA9-475ADE95474F}\TypeLib\ = "{98F7345A-794A-4CE9-A1F6-F02AF3896E65}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E4C918DF-A6FD-4D0B-BC5C-F670439F22CD}\ = "PPLive PPLFlv Splitter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\splayer.SPlayer\ = "SPlayer Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}\ProgID\ = "splayer.SPlayer.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E4C918DF-A6FD-4D0B-BC5C-F670439F22CD}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$PLUGINSDIR\\OPlayer.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E4C918DF-A6FD-4D0B-BC5C-F670439F22CD}\CLSID = "{E4C918DF-A6FD-4D0B-BC5C-F670439F22CD}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\splayer.SPlayer\CLSID\ = "{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2436	2276	regsvr32.exe	28
PID 2276 wrote to memory of 2436	2276	regsvr32.exe	28
PID 2276 wrote to memory of 2436	2276	regsvr32.exe	28
PID 2276 wrote to memory of 2436	2276	regsvr32.exe	28
PID 2276 wrote to memory of 2436	2276	regsvr32.exe	28
PID 2276 wrote to memory of 2436	2276	regsvr32.exe	28
PID 2276 wrote to memory of 2436	2276	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\OPlayer.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\OPlayer.dll
  2⤵
  - Modifies registry class
  PID:2436

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads