b92b4f05ced0a9d216725f0d4e1faf7ff850b834e0f1ffa1d79423ee071d92cc

Analysis

max time kernel
93s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Plugins/Gracenote/CddbPlaylist2Winamp.dll
Size

569KB
MD5

511769c5084cee6151ab8e8236aaa597
SHA1

00e1e0fe54f218c200b3fe15e73844c82a67ffb7
SHA256

db4f88cd577da58cc09340923cc1488d7d7eacb2a0eeccfd0dc412ed43c3ea44
SHA512

53e5b2c39a85eec4088933881ef0a8513fbfcc8eeda8fbd583f9cf89d753ec09d09531a75346a01aebed56e21bf2e4ef0633a8ef9b189520766946b999c6bdc1
SSDEEP

12288:XhPdcan5yuZSV4agcO2zFh57Yx0dCFlvXf:XIa5Gs4GyCf

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPLGeneratorList\CurVer\ = "CddbPlaylist2NSWinamp.CddbPLGeneratorList.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7052a035-2aee-4d5d-be82-6b12437bfcba}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7052a035-2aee-4d5d-be82-6b12437bfcba}\TypeLib\ = "{7919d0ca-3043-4c02-b778-ab2bf4931f58}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d374ceca-3e86-4ab4-87a9-3ff7e03e3cad}\VersionIndependentProgID\ = "CddbPlaylistNSWinamp.CddbMLDBManager"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7919D0CA-3043-4C02-B778-AB2BF4931F58}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plugins\\Gracenote\\CddbPlaylist2Winamp.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8D951C2E-56FB-4E0B-903C-FE738DA573C1}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPL2FindData\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d7fbfb00-25ec-41f6-b64e-fab7668d5b75}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPLGenRank\CLSID\ = "{bf1caa94-1d1c-4ae7-b94c-10fdc05f493d}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b3f484a1-e3b4-4ad5-a9a9-52592a08dbd2}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A58522B9-6B50-4033-9246-1EC5701ED85C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8D951C2E-56FB-4E0B-903C-FE738DA573C1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0281A5E7-BD75-4ED3-9872-3331157B923D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{15D93D1E-50F1-444C-9E76-E4C8ACA0A29D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPL2FindData.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2C6C4EE-32FE-4BB7-8A47-DC615034BD7C}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7919D0CA-3043-4C02-B778-AB2BF4931F58}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA9A4BA6-1879-4A32-82C8-BD84D8FADF00}\TypeLib\ = "{7919D0CA-3043-4C02-B778-AB2BF4931F58}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bf1caa94-1d1c-4ae7-b94c-10fdc05f493d}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{783dcf23-fde3-44e1-ad01-c8100596a81b}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plugins\\Gracenote\\CddbPlaylist2Winamp.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A58522B9-6B50-4033-9246-1EC5701ED85C}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6AC694D3-4E30-47F3-93DD-236DBB308715}\ = "ICddbPL2Result"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2C6C4EE-32FE-4BB7-8A47-DC615034BD7C}\ = "ICddbEra"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPLGenCriteria\ = "CddbPLGenCriteria Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPLGenRank.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPLGenRank.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34655D2E-8550-421F-A67D-A002F14D8D5E}\ = "ICddbPlaylist2Mgr"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5311019A-98C9-4377-B8CF-72C00A55914A}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D79FFAF8-1BC2-4BDE-B5F7-1BAA899865D2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D79FFAF8-1BC2-4BDE-B5F7-1BAA899865D2}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3580DEE2-B1D1-46AE-88B0-CBAC62D1E157}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f78ae80a-3ef5-498e-bf16-7696f7d31fed}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plugins\\Gracenote\\CddbPlaylist2Winamp.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE4E7FEB-EE3A-4A41-B370-AE37E656BE29}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8D8EE69-E17D-442F-BB11-D8A1A214FEBA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DBBC42AC-1409-4D95-98FC-7F6ACB33EC15}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPL2FindData	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7f403f21-383b-4faf-94c7-e2c2f487f926}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPLMoreLikeThisCfg.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8D8EE69-E17D-442F-BB11-D8A1A214FEBA}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{84E284D8-34CC-4337-B1DC-D7D6F0E431CB}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B282F975-AC68-41C1-BDED-DE683BB8E403}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{783dcf23-fde3-44e1-ad01-c8100596a81b}\ProgID\ = "CddbPlaylist2NSWinamp.CddbPLGenLimit.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d374ceca-3e86-4ab4-87a9-3ff7e03e3cad}\TypeLib\ = "{7919d0ca-3043-4c02-b778-ab2bf4931f58}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BA5342DC-41D7-4954-9501-FDC6ACD0DC2F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7f403f21-383b-4faf-94c7-e2c2f487f926}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPLGenLimit\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPLInfo\CurVer\ = "CddbPlaylist2NSWinamp.CddbPLInfo.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPLMoreLikeThisCfg\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A58522B9-6B50-4033-9246-1EC5701ED85C}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A58522B9-6B50-4033-9246-1EC5701ED85C}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C0E6E3A0-2FCF-4A33-8E55-19920B83D759}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0281A5E7-BD75-4ED3-9872-3331157B923D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbNSWinampPlaylist2Mgr\CLSID\ = "{39c806ec-eb0a-4f6e-b40d-c41d92281b5e}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3580DEE2-B1D1-46AE-88B0-CBAC62D1E157}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d7fbfb00-25ec-41f6-b64e-fab7668d5b75}\VersionIndependentProgID\ = "CddbPlaylist2NSWinamp.CddbPLGeneratorList"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPLGenCriteria	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bf1caa94-1d1c-4ae7-b94c-10fdc05f493d}\VersionIndependentProgID\ = "CddbPlaylist2NSWinamp.CddbPLGenRank"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0E6E3A0-2FCF-4A33-8E55-19920B83D759}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6E1EEEE1-7227-4BAD-B955-B84BEA914A5A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE4E7FEB-EE3A-4A41-B370-AE37E656BE29}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fe4c8bff-961f-42c2-bad8-808f76edde15}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b3f484a1-e3b4-4ad5-a9a9-52592a08dbd2}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0E6E3A0-2FCF-4A33-8E55-19920B83D759}\TypeLib\ = "{7919D0CA-3043-4C02-B778-AB2BF4931F58}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B0C8851A-0209-419B-84BC-1D03E6A0DC86}\ = "ICddbPL2FindData"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 5096	3336	regsvr32.exe	84
PID 3336 wrote to memory of 5096	3336	regsvr32.exe	84
PID 3336 wrote to memory of 5096	3336	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Plugins\Gracenote\CddbPlaylist2Winamp.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Plugins\Gracenote\CddbPlaylist2Winamp.dll
  2⤵
  - Modifies registry class
  PID:5096

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads