b92b4f05ced0a9d216725f0d4e1faf7ff850b834e0f1ffa1d79423ee071d92cc

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Plugins/Gracenote/CDDBControlWinamp.dll
Size

776KB
MD5

9b08f4a3238eb10f4bcbd3f1125d81b4
SHA1

35da23645424a42cdbb06586f2ec994736516c5e
SHA256

1f97571a866c0877401adc316f314cc8ed44731808e770327ffbcb9f8841fb6b
SHA512

55b7b411d8442e7869333399cbb2ad087a672a165834b124f0dd7dd9c26d38575b9f3e1f423d6367c0ebcecef7ff180201a27489015ea0bc8e67b4532d29f955
SSDEEP

24576:c65APsrqWM0iGEQlLRQF7CeMAB0m0iYYEtT8BfL:R5qFuXTC

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{993bb5e2-4a0d-4ed0-bd37-8718c422997e}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlNSWinamp.CddbWMATag\CurVer\ = "CDDBControlNSWinamp.CddbWMATag.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CF6268FD-7BA3-4CC5-9DE1-FEAD923D216C}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{686F7BCE-1EDB-4540-8C25-BBA9CE7B2323}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B2D9EB8-70AA-43D3-AA8E-E71CE53A83D8}\ = "ICddbID3Tag"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44959787-915B-4FCF-9763-1038483C000E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7416f5ca-8922-4516-89e8-d826a8c091c5}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5220E8FA-B11F-46CF-9786-51B11E05F657}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31480E0F-DE17-4CAE-8D85-1DB90F9FCD2F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{751E8ACE-610B-4336-B425-5038154F68A2}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D6F791C8-A7F7-4702-9D24-4B8F8CA4C807}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2758dffc-f9fb-4c62-82c9-fdc9bceb5e9c}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7416f5ca-8922-4516-89e8-d826a8c091c5}\ = "CddbUIOptions Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44959787-915B-4FCF-9763-1038483C000E}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06C18BA6-86A0-464C-B838-13A74E1AD049}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{686F7BCE-1EDB-4540-8C25-BBA9CE7B2323}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63C7D158-BCA0-4C29-96C4-06BDD744ECC2}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{24959692-AAC0-411D-9E6B-C7611FCCACBA}\ = "ICddbTrack2_5"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7416f5ca-8922-4516-89e8-d826a8c091c5}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7DA05059-CFB4-46CE-A788-709A3AD3454D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0BA44DA2-A91D-4C60-8E48-61B5E69495EA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA3218D8-A65C-4A29-8690-1E5B75DBF3B8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C412E44B-A911-4E2E-AB26-F12BDB23EE55}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C412E44B-A911-4E2E-AB26-F12BDB23EE55}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C412E44B-A911-4E2E-AB26-F12BDB23EE55}\TypeLib\ = "{65EBA1D4-45E2-4EC5-A7FF-CB7E14659C77}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2758dffc-f9fb-4c62-82c9-fdc9bceb5e9c}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlNSWinamp.CddbURLManager.1\CLSID\ = "{dccf8d5f-c1f6-44a1-b065-60d56557f821}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7DA05059-CFB4-46CE-A788-709A3AD3454D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06C77E4D-FE13-4FA4-B52A-1CF2E047F55F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{37668F25-B3FF-42EA-A3F9-25EA0740902E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d5673322-c7a0-493a-98d5-f16da00724aa}\VersionIndependentProgID\ = "CDDBControlNSWinamp.CddbFullName"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B6107AD-D1F2-41C3-B9B9-3349324F7E7B}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2AAE501A-6D20-4AF3-8C79-473106BD5391}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C30FBC5C-F56C-40DD-841D-5E4428F3BAEA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{719C744F-CDEF-49C2-9ADA-DF5BA8770F4B}\ = "ICddbLanguageList"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CF6268FD-7BA3-4CC5-9DE1-FEAD923D216C}\ = "ICddbFieldList"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F19A9D2D-2287-4C64-96C7-4BB63EDEC9C5}\ = "ICddbDataListElement"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49D2A10D-A5F3-4BD0-9C15-6B2B94F16593}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d5673322-c7a0-493a-98d5-f16da00724aa}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4570CDDC-94F8-4B43-B1AC-796D68FAC7DF}\ = "ICddbUserInfo"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B6107AD-D1F2-41C3-B9B9-3349324F7E7B}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B3BE7EE-9A6E-4276-8701-3A85F5D9E3C5}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0BA44DA2-A91D-4C60-8E48-61B5E69495EA}\ = "ICddbRoleTree"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE5E5B63-8154-4CB0-8FFC-A0AAB7DBE9D5}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlNSWinamp.CddbDisc	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlNSWinamp.CddbSegment\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{686F7BCE-1EDB-4540-8C25-BBA9CE7B2323}\TypeLib\ = "{65EBA1D4-45E2-4EC5-A7FF-CB7E14659C77}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{37668F25-B3FF-42EA-A3F9-25EA0740902E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlNSWinamp.CddbFullName.1\CLSID\ = "{d5673322-c7a0-493a-98d5-f16da00724aa}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlNSWinamp.CddbExtData\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{84F40113-D6CA-4289-ACFA-B8B1691E596B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{719C744F-CDEF-49C2-9ADA-DF5BA8770F4B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fb51cc6e-a66e-4c28-bef5-142d4927e1cf}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plugins\\Gracenote\\CDDBControlWinamp.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4570CDDC-94F8-4B43-B1AC-796D68FAC7DF}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlNSWinamp.CddbInfoWindow.1\ = "CddbInfoWindow Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF6268FD-7BA3-4CC5-9DE1-FEAD923D216C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44959787-915B-4FCF-9763-1038483C000E}\TypeLib\ = "{65EBA1D4-45E2-4EC5-A7FF-CB7E14659C77}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06C77E4D-FE13-4FA4-B52A-1CF2E047F55F}\TypeLib\ = "{65EBA1D4-45E2-4EC5-A7FF-CB7E14659C77}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlNSWinamp.CddbDisc\CurVer\ = "CDDBControlNSWinamp.CddbDisc.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61bd27fe-604c-49f8-a979-7a260a51ea5f}\ = "CddbCredit Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9bac7636-3c83-4a17-bc39-aeff43f8780b}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{84F40113-D6CA-4289-ACFA-B8B1691E596B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7416f5ca-8922-4516-89e8-d826a8c091c5}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D0F041D4-1570-4143-BB6A-4CE041B109D4}\TypeLib\ = "{65EBA1D4-45E2-4EC5-A7FF-CB7E14659C77}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 4500	4200	regsvr32.exe	85
PID 4200 wrote to memory of 4500	4200	regsvr32.exe	85
PID 4200 wrote to memory of 4500	4200	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Plugins\Gracenote\CDDBControlWinamp.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Plugins\Gracenote\CDDBControlWinamp.dll
  2⤵
  - Modifies registry class
  PID:4500

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads