265c863c1cda7c59859a7e222b30dbadfa2728f0211269ac6f38636e4c486992 | Triage

Analysis

max time kernel
94s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 03:59

Sharing

Report Analysis Logs

General

Target

$SYSDIR/avi2ac3filter.dll
Size

152KB
MD5

c2a0912e5760158ffee79803871c8e31
SHA1

08d42f3f8463ac73775283033b0f032e4ffb3aba
SHA256

0d3016ea184f98c9ccde64f896b6a09fc69c817698597df06768b9f5dd2c9030
SHA512

2ad2f5dc0cdbf73c9c93e30f6cd2b86aa680d817c71d5b0ef9d3c6181a2ba6bb209fc55e69702d280f6cd8249e2c4ba4120e78e155e378d8523c80f966e76c50
SSDEEP

3072:f7b2nHKSKTxJpgM3Pr2XfwfxlY8D4USl/9Za9WpH:WKSCx71+qxlY80d9Zgq

Score

1^/10

Malware Config

Signatures

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93230DD0-7B3C-4EFB-AFBB-DC380FEC9E6B}\ = "AVI2AC3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{93230DD0-7B3C-4EFB-AFBB-DC380FEC9E6B}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{93230DD0-7B3C-4EFB-AFBB-DC380FEC9E6B}\FilterData = 020000000000400002000000000000003070693300000000000000000200000000000000000000003074793300000000700000008000000031747933000000007000000090000000317069330800000000000000010000000000000000000000307479330000000070000000a00000006175647300001000800000aa00389b710020000000001000800000aa00389b710120000000001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{93230DD0-7B3C-4EFB-AFBB-DC380FEC9E6B}\FriendlyName = "AVI<->AC3/DTS"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{93230DD0-7B3C-4EFB-AFBB-DC380FEC9E6B}\CLSID = "{93230DD0-7B3C-4EFB-AFBB-DC380FEC9E6B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93230DD0-7B3C-4EFB-AFBB-DC380FEC9E6B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93230DD0-7B3C-4EFB-AFBB-DC380FEC9E6B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93230DD0-7B3C-4EFB-AFBB-DC380FEC9E6B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\avi2ac3filter.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93230DD0-7B3C-4EFB-AFBB-DC380FEC9E6B}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 3564	4964	regsvr32.exe	83
PID 4964 wrote to memory of 3564	4964	regsvr32.exe	83
PID 4964 wrote to memory of 3564	4964	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\avi2ac3filter.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\avi2ac3filter.dll
  2⤵
  - Modifies registry class
  PID:3564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads