e67777b181a1ca1f21890bd0da9b177bcd850498375af8f1b0d3d61c7a54c9d0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/OPlayer.dll
Size

1.2MB
MD5

ca3028a6adee108bb3fd4657e9632355
SHA1

43be6285c5f7ed07062dce2f23171b7965147f98
SHA256

57ee68455ef1219b05d8efea12beeba73a1ef03608756e693706b5096c2a558f
SHA512

47461d1797170e62fcb5170f22b859046dc09541614044a29c8c56377ffa30780dc8e1210b6a2600232f1e3fd68c26493e47d6b90367acf8396b430f7092e601
SSDEEP

24576:nYwfR3koBM2m5FoxgQ+esJjuGOYI9j7MgjZhm9xHyxrRa/J7I7w8+6aQ20it7:ndkLzJCGOYI9j7Mg9hmz2rRa/FI7w30U

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\splayer.SPlayer.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{03CFFB0B-98E4-4BB3-B764-5DD3D4B28878}\TypeLib\ = "{98F7345A-794A-4CE9-A1F6-F02AF3896E65}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A30BDD15-203E-41B1-8896-A13B389DEBCE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ppl\Extensions\.mp4 = "{8c180c13-3d60-425f-a554-8ae406d6447a}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}\ = "SPlayer Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98F7345A-794A-4CE9-A1F6-F02AF3896E65}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03CFFB0B-98E4-4BB3-B764-5DD3D4B28878}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A30BDD15-203E-41B1-8896-A13B389DEBCE}\TypeLib\ = "{98F7345A-794A-4CE9-A1F6-F02AF3896E65}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A30BDD15-203E-41B1-8896-A13B389DEBCE}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\splayer.SPlayer\CLSID\ = "{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57D9A92E-7A5C-4119-9AA9-475ADE95474F}\ = "IVideoProcAmp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98F7345A-794A-4CE9-A1F6-F02AF3896E65}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$PLUGINSDIR\\OPlayer.dll"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E4C918DF-A6FD-4D0B-BC5C-F670439F22CD}\FilterData = 02000000000020000100000000000000307069330800000000000000000000000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C180C13-3D60-425F-A554-8AE406D6447A}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98F7345A-794A-4CE9-A1F6-F02AF3896E65}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{03CFFB0B-98E4-4BB3-B764-5DD3D4B28878}\ = "_ISPlayerEvents"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{8C180C13-3D60-425F-A554-8AE406D6447A}\FilterData = 02000000000020000100000000000000307069330800000000000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A30BDD15-203E-41B1-8896-A13B389DEBCE}\ = "ISPlayer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}\TypeLib\ = "{98F7345A-794A-4CE9-A1F6-F02AF3896E65}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98F7345A-794A-4CE9-A1F6-F02AF3896E65}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57D9A92E-7A5C-4119-9AA9-475ADE95474F}\ = "IVideoProcAmp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57D9A92E-7A5C-4119-9AA9-475ADE95474F}\TypeLib\ = "{98F7345A-794A-4CE9-A1F6-F02AF3896E65}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57D9A92E-7A5C-4119-9AA9-475ADE95474F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ppl\ = "PPLive Media Server"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57D9A92E-7A5C-4119-9AA9-475ADE95474F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98F7345A-794A-4CE9-A1F6-F02AF3896E65}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98F7345A-794A-4CE9-A1F6-F02AF3896E65}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03CFFB0B-98E4-4BB3-B764-5DD3D4B28878}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C180C13-3D60-425F-A554-8AE406D6447A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$PLUGINSDIR\\OPlayer.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\splayer.SPlayer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}\ProgID\ = "splayer.SPlayer.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A30BDD15-203E-41B1-8896-A13B389DEBCE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57D9A92E-7A5C-4119-9AA9-475ADE95474F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\splayer.SPlayer\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{8C180C13-3D60-425F-A554-8AE406D6447A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03CFFB0B-98E4-4BB3-B764-5DD3D4B28878}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03CFFB0B-98E4-4BB3-B764-5DD3D4B28878}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E4C918DF-A6FD-4D0B-BC5C-F670439F22CD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\splayer.SPlayer\CurVer\ = "splayer.SPlayer.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{98F7345A-794A-4CE9-A1F6-F02AF3896E65}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57D9A92E-7A5C-4119-9AA9-475ADE95474F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E4C918DF-A6FD-4D0B-BC5C-F670439F22CD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\splayer.SPlayer.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{8C180C13-3D60-425F-A554-8AE406D6447A}\CLSID = "{8C180C13-3D60-425F-A554-8AE406D6447A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A30BDD15-203E-41B1-8896-A13B389DEBCE}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A30BDD15-203E-41B1-8896-A13B389DEBCE}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A30BDD15-203E-41B1-8896-A13B389DEBCE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\splayer.SPlayer\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$PLUGINSDIR\\OPlayer.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57D9A92E-7A5C-4119-9AA9-475ADE95474F}\TypeLib\ = "{98F7345A-794A-4CE9-A1F6-F02AF3896E65}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E4C918DF-A6FD-4D0B-BC5C-F670439F22CD}\CLSID = "{E4C918DF-A6FD-4D0B-BC5C-F670439F22CD}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\splayer.SPlayer\ = "SPlayer Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\splayer.SPlayer.1\ = "SPlayer Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}\VersionIndependentProgID\ = "splayer.SPlayer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ppl	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03CFFB0B-98E4-4BB3-B764-5DD3D4B28878}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E4C918DF-A6FD-4D0B-BC5C-F670439F22CD}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\splayer.SPlayer.1\CLSID\ = "{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF5C13D1-B5C2-4B43-868B-C1482B5BBEB0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{03CFFB0B-98E4-4BB3-B764-5DD3D4B28878}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 3040	4076	regsvr32.exe	85
PID 4076 wrote to memory of 3040	4076	regsvr32.exe	85
PID 4076 wrote to memory of 3040	4076	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\OPlayer.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\OPlayer.dll
  2⤵
  - Modifies registry class
  PID:3040

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads