1606a6aa8faad26ad780f7e9d71e61f30ebeb69caa6eed3d1a5691142e090c69

Analysis

max time kernel
9s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$COMMONFILES/QvodPlayer/Codecs/cdxareader.dll
Size

244KB
MD5

214ecdcd1322bf817a870a7c6226da36
SHA1

e828e52d01a576dabbc12bca33b9e5ebbdc961e9
SHA256

7ab9e71d507abc1a9b04f5cc5cb53eaee4ffbd13150b7d4cd5a326b377700189
SHA512

7f5cb8cc39ce866aaac57e07caf64d454ef9c00f43833b097da4dd0b1430a0aef5cd97a9d454af53fdd9cc56474f82c01e57780b22c75bd2230d173e7a9ad97d
SSDEEP

3072:vdCHWCvnaXCTbGe4znEIgdW6yJPBzqm8dbh+Z1OkRUxtfXAkscB/naVuU:p6TbGTEIgdoJ5zBA0ZQwsXAkV5aV

Score

1^/10

Malware Config

Signatures

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D367878E-F3B8-4235-A968-F378EF1B9A44}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D367878E-F3B8-4235-A968-F378EF1B9A44}\FriendlyName = "CDXA Reader"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D367878E-F3B8-4235-A968-F378EF1B9A44}\CLSID = "{D367878E-F3B8-4235-A968-F378EF1B9A44}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{D367878E-F3B8-4235-A968-F378EF1B9A44}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D367878E-F3B8-4235-A968-F378EF1B9A44}\ = "CDXA Reader"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D367878E-F3B8-4235-A968-F378EF1B9A44}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D367878E-F3B8-4235-A968-F378EF1B9A44}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D367878E-F3B8-4235-A968-F378EF1B9A44}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$COMMONFILES\\QvodPlayer\\Codecs\\cdxareader.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D367878E-F3B8-4235-A968-F378EF1B9A44}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D367878E-F3B8-4235-A968-F378EF1B9A44}\FilterData = 020000000000400001000000000000003070693308000000000000000100000000000000000000003074793300000000380000004800000083eb36e44f52ce119f530020af0ba77000000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{D367878E-F3B8-4235-A968-F378EF1B9A44}\0 = "0,4,,52494646,8,4,,43445841"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{D367878E-F3B8-4235-A968-F378EF1B9A44}\Source Filter = "{D367878E-F3B8-4235-A968-F378EF1B9A44}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2148	2476	regsvr32.exe	29
PID 2476 wrote to memory of 2148	2476	regsvr32.exe	29
PID 2476 wrote to memory of 2148	2476	regsvr32.exe	29
PID 2476 wrote to memory of 2148	2476	regsvr32.exe	29
PID 2476 wrote to memory of 2148	2476	regsvr32.exe	29
PID 2476 wrote to memory of 2148	2476	regsvr32.exe	29
PID 2476 wrote to memory of 2148	2476	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\QvodPlayer\Codecs\cdxareader.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\QvodPlayer\Codecs\cdxareader.dll
  2⤵
  - Modifies registry class
  PID:2148

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads