5ed97453be92c324567e6d0baf4bc7d001b5925e71ad957e495463893ed1af1d

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mp3Enc.dll
Size

174KB
MD5

9852059e98ee194c896febfe46c93be6
SHA1

c95aaace1352e781e70c7d1d7c663a3376e203e1
SHA256

3c5f3e499db9e2a4c52301e5d0160687b695084bc2007db4c7fe34b87e1bb85f
SHA512

9162398c2587ebf1fa53d1a0ca6647aba0dc6b336005793de34dbf06a9059c76df71f07a510eebb2a48b0780d22190fdee126c11f68fb24ab56cd5e7d57f1a2d
SSDEEP

3072:MooAjrTQrnQatIDmTEzxy2cpImwPWAmVfALaYyo2PMsj2YqBZF5c9:MsTUqDu22hwPWAmSLI2Yqn

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFBEC4C3-839E-11D1-85FE-0020AFE4DE54}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C7-839E-11D1-85FE-0020AFE4DE54}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Mp3Enc.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFBEC4C4-839E-11D1-85FE-0020AFE4DE54}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFBEC4C3-839E-11D1-85FE-0020AFE4DE54}\1.0\FLAGS\ = "2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFBEC4C3-839E-11D1-85FE-0020AFE4DE54}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Mp3Enc.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFBEC4C4-839E-11D1-85FE-0020AFE4DE54}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFBEC4C4-839E-11D1-85FE-0020AFE4DE54}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFBEC4C4-839E-11D1-85FE-0020AFE4DE54}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFBEC4C3-839E-11D1-85FE-0020AFE4DE54}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFBEC4C3-839E-11D1-85FE-0020AFE4DE54}\1.0\ = "Dialog-Medien MP3Enc ActiveX Control module"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}\Control\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFBEC4C3-839E-11D1-85FE-0020AFE4DE54}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Mp3Enc.Mp3EncCtrl.1\CLSID\ = "{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFBEC4C5-839E-11D1-85FE-0020AFE4DE54}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Mp3Enc.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C7-839E-11D1-85FE-0020AFE4DE54}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFBEC4C3-839E-11D1-85FE-0020AFE4DE54}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFBEC4C5-839E-11D1-85FE-0020AFE4DE54}\ = "_DMp3EncEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFBEC4C3-839E-11D1-85FE-0020AFE4DE54}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFBEC4C5-839E-11D1-85FE-0020AFE4DE54}\TypeLib\ = "{FFBEC4C3-839E-11D1-85FE-0020AFE4DE54}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFBEC4C5-839E-11D1-85FE-0020AFE4DE54}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFBEC4C5-839E-11D1-85FE-0020AFE4DE54}\ = "_DMp3EncEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}\TypeLib\ = "{FFBEC4C3-839E-11D1-85FE-0020AFE4DE54}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFBEC4C4-839E-11D1-85FE-0020AFE4DE54}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFBEC4C4-839E-11D1-85FE-0020AFE4DE54}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFBEC4C4-839E-11D1-85FE-0020AFE4DE54}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFBEC4C5-839E-11D1-85FE-0020AFE4DE54}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFBEC4C3-839E-11D1-85FE-0020AFE4DE54}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFBEC4C4-839E-11D1-85FE-0020AFE4DE54}\ = "_DMp3Enc"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C7-839E-11D1-85FE-0020AFE4DE54}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFBEC4C4-839E-11D1-85FE-0020AFE4DE54}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Mp3Enc.Mp3EncCtrl.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}\ProgID\ = "Mp3Enc.Mp3EncCtrl.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFBEC4C4-839E-11D1-85FE-0020AFE4DE54}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFBEC4C5-839E-11D1-85FE-0020AFE4DE54}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Mp3Enc.Mp3EncCtrl.1\ = "Dialog-Medien Mp3Enc Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Mp3Enc.dll, 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFBEC4C4-839E-11D1-85FE-0020AFE4DE54}\ = "_DMp3Enc"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFBEC4C5-839E-11D1-85FE-0020AFE4DE54}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFBEC4C5-839E-11D1-85FE-0020AFE4DE54}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFBEC4C5-839E-11D1-85FE-0020AFE4DE54}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFBEC4C5-839E-11D1-85FE-0020AFE4DE54}\TypeLib\ = "{FFBEC4C3-839E-11D1-85FE-0020AFE4DE54}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}\ = "Dialog-Medien Mp3Enc Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C7-839E-11D1-85FE-0020AFE4DE54}\ = "Dialog-Medien Mp3Enc Property Page"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFBEC4C3-839E-11D1-85FE-0020AFE4DE54}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFBEC4C5-839E-11D1-85FE-0020AFE4DE54}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFBEC4C5-839E-11D1-85FE-0020AFE4DE54}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Mp3Enc.Mp3EncCtrl.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}\MiscStatus\1\ = "131473"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFBEC4C4-839E-11D1-85FE-0020AFE4DE54}\TypeLib\ = "{FFBEC4C3-839E-11D1-85FE-0020AFE4DE54}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFBEC4C5-839E-11D1-85FE-0020AFE4DE54}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFBEC4C6-839E-11D1-85FE-0020AFE4DE54}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FFBEC4C4-839E-11D1-85FE-0020AFE4DE54}\TypeLib\ = "{FFBEC4C3-839E-11D1-85FE-0020AFE4DE54}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFBEC4C4-839E-11D1-85FE-0020AFE4DE54}\TypeLib\Version = "1.0"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2864	2552	regsvr32.exe	28
PID 2552 wrote to memory of 2864	2552	regsvr32.exe	28
PID 2552 wrote to memory of 2864	2552	regsvr32.exe	28
PID 2552 wrote to memory of 2864	2552	regsvr32.exe	28
PID 2552 wrote to memory of 2864	2552	regsvr32.exe	28
PID 2552 wrote to memory of 2864	2552	regsvr32.exe	28
PID 2552 wrote to memory of 2864	2552	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Mp3Enc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Mp3Enc.dll
  2⤵
  - Modifies registry class
  PID:2864

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads