e95b5f032ed246f3f9c0bc27017e46940056f5c5fa3dbb7b2f6e0c965e69a4f2 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 16:27

Sharing

Report Analysis Logs

General

Target

YiqilaiLyrics.dll
Size

136KB
MD5

66bd35c77e80654b1ef1956d1843cbdd
SHA1

851e8dae6a4e0df8a6d8d3dfb08f7d8944d39567
SHA256

e64e38ec3b496c6e65c1dd68e2f499824ed1b1269f0240900dd1d567bb80ecae
SHA512

ffddcb28ae2235c68ae6b0fbabf746e5d28311ea1d5d2a8f19bdcd7df6300383fb5bfa384a270f99eab0fd4247d936425f44c2fae9ba1c4d70aa886ca480284a
SSDEEP

3072:PcroPnyMEfcv3V4/m22ZzgN4tQGXn+Mra:MoPQfYWOVZMNZe

Score

1^/10

Malware Config

Signatures

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DBC6ADB-5788-4FB9-AEC3-B40A58AC11DF}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DBC6ADB-5788-4FB9-AEC3-B40A58AC11DF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YiqilaiLyrics.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DBC6ADB-5788-4FB9-AEC3-B40A58AC11DF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DBC6ADB-5788-4FB9-AEC3-B40A58AC11DF}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DBC6ADB-5788-4FB9-AEC3-B40A58AC11DF}\TypeLib\ = "{029FC9F0-08CA-4963-AC64-763CD37F826E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DBC6ADB-5788-4FB9-AEC3-B40A58AC11DF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7DBC6ADB-5788-4FB9-AEC3-B40A58AC11DF}\ = "YiqilaiLyrics Class"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1700	3056	regsvr32.exe	28
PID 3056 wrote to memory of 1700	3056	regsvr32.exe	28
PID 3056 wrote to memory of 1700	3056	regsvr32.exe	28
PID 3056 wrote to memory of 1700	3056	regsvr32.exe	28
PID 3056 wrote to memory of 1700	3056	regsvr32.exe	28
PID 3056 wrote to memory of 1700	3056	regsvr32.exe	28
PID 3056 wrote to memory of 1700	3056	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\YiqilaiLyrics.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\YiqilaiLyrics.dll
  2⤵
  - Modifies registry class
  PID:1700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads