45c5b0a5769677b7136986ec96690c635ef5e7ea81411e76da2482d20f6f923b

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Captivate/Avi2Swf.dll
Size

400KB
MD5

546b2621d33021f57a63af9159d7180d
SHA1

9e4ca8f64db03bfca437b79bc538c8da434ba544
SHA256

eb6fd243c48e4e81f7ee7e4fadf302f9e87052223f520795da8bc9f89a2b7940
SHA512

ecf4722531b376fd580348511493253eb35ece483e74b5a11f45ffbbdc513d4239d6ebf88f06933856265f61eccf1c1dde141f2aba6bdef2aa60b22ceac23699
SSDEEP

6144:aLM2WcUxQH0SIxP7O7KZWd1a1nRCm2m9ImQrIg0t:aLBWcMQH0S0OWZeu19hXt

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Avi2swf.AviToFlashConverter\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Avi2swf.AviToFlashConverter\CLSID\ = "{B366A55E-9A9B-48c4-B30A-7C048AD14376}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B366A55E-9A9B-48c4-B30A-7C048AD14376}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B366A55E-9A9B-48c4-B30A-7C048AD14376}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Avi2swf.AviToFlashConverter.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Avi2swf.AviToFlashConverter\ = "AviToFlashConverter Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Avi2swf.AviToFlashConverter\CurVer\ = "Avi2swf.AviToFlashConverter.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B366A55E-9A9B-48c4-B30A-7C048AD14376}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Captivate\\Avi2Swf.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B366A55E-9A9B-48c4-B30A-7C048AD14376}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B366A55E-9A9B-48c4-B30A-7C048AD14376}\TypeLib\ = "{A55EBD7D-410A-49ad-8772-EA4FF703AD3D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B366A55E-9A9B-48c4-B30A-7C048AD14376}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B366A55E-9A9B-48c4-B30A-7C048AD14376}\ProgID\ = "Avi2swf.AviToFlashConverter.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B366A55E-9A9B-48c4-B30A-7C048AD14376}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Avi2swf.AviToFlashConverter	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Avi2swf.AviToFlashConverter\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B366A55E-9A9B-48c4-B30A-7C048AD14376}\ = "AviToFlashConverter Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B366A55E-9A9B-48c4-B30A-7C048AD14376}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B366A55E-9A9B-48c4-B30A-7C048AD14376}\VersionIndependentProgID\ = "Avi2swf.AviToFlashConverter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Avi2swf.AviToFlashConverter.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Avi2swf.AviToFlashConverter.1\ = "AviToFlashConverter Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Avi2swf.AviToFlashConverter.1\CLSID\ = "{B366A55E-9A9B-48c4-B30A-7C048AD14376}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B366A55E-9A9B-48c4-B30A-7C048AD14376}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2796	2672	regsvr32.exe	30
PID 2672 wrote to memory of 2796	2672	regsvr32.exe	30
PID 2672 wrote to memory of 2796	2672	regsvr32.exe	30
PID 2672 wrote to memory of 2796	2672	regsvr32.exe	30
PID 2672 wrote to memory of 2796	2672	regsvr32.exe	30
PID 2672 wrote to memory of 2796	2672	regsvr32.exe	30
PID 2672 wrote to memory of 2796	2672	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Captivate\Avi2Swf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Captivate\Avi2Swf.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2796-0-0x00000000021F0000-0x00000000022F2000-memory.dmp

Filesize
1.0MB

Download