Analysis
-
max time kernel
84s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-08-2024 10:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8255684b491d8f80568eb60cff51d620N.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
-
Target
8255684b491d8f80568eb60cff51d620N.dll
-
Size
213KB
-
MD5
8255684b491d8f80568eb60cff51d620
-
SHA1
87b97e1819c5fe9c888ba02b5298ba72b1f793c6
-
SHA256
d3d197e953eacd36dafcb4853f7ea97d3b59c0d39c63670655871edc8797b1f5
-
SHA512
2a10b468cd1d77bca26c6195651ad1dab31d10913e20d407e44ddc3f49fa625365414dca422f70a58ccc586d4dd21a06ff06036bceede3baa9dca9cc9739b784
-
SSDEEP
3072:O+s0jl0u/lfntkoMRbSgZQgsS4iYCmoBnihpbcKIMXBJGTcjuGc/S:OGtfnCXWVSihpbJGLf/
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 61 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicSignPostTrack\CurVer\ = "Microsoft.DirectMusicSignPostTrack.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicChordMapTrack\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicChordMap regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicChordMap.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicTemplate.1\ = "DirectMusicTemplate" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicChordMap\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D30BCC65-60E8-11D1-A7CE-00A0C913F73C}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2AC2896-B39B-11D1-8704-00600893B1BD}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicChordMap.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicComposer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicComposer.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicTemplate\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicSignPostTrack regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicChordMapTrack.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicChordMap\CurVer\ = "Microsoft.DirectMusicChordMap.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2AC2890-B39B-11D1-8704-00600893B1BD}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D30BCC65-60E8-11D1-A7CE-00A0C913F73C}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicTemplate.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F17E8672-C3B4-11D1-870B-00600893B1BD}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2AC288F-B39B-11D1-8704-00600893B1BD}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicChordMap\ = "DirectMusicChordMap" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2AC2890-B39B-11D1-8704-00600893B1BD}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicSignPostTrack.1\ = "DirectMusicSignPostTrack" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2AC2896-B39B-11D1-8704-00600893B1BD} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2AC288F-B39B-11D1-8704-00600893B1BD}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2AC2890-B39B-11D1-8704-00600893B1BD} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicComposer.1\ = "DirectMusicComposer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicComposer.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicTemplate regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F17E8672-C3B4-11D1-870B-00600893B1BD}\InProcServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicSignPostTrack\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicSignPostTrack\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicComposer\ = "DirectMusicComposer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicComposer\CurVer\ = "Microsoft.DirectMusicComposer.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicTemplate\ = "DirectMusicTemplate" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicTemplate.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F17E8672-C3B4-11D1-870B-00600893B1BD} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F17E8672-C3B4-11D1-870B-00600893B1BD}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2AC2890-B39B-11D1-8704-00600893B1BD}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2AC2896-B39B-11D1-8704-00600893B1BD}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicChordMapTrack\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicChordMapTrack\ = "DirectMusicChordMapTrack" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicChordMapTrack\CurVer\ = "Microsoft.DirectMusicChordMapTrack.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2AC288F-B39B-11D1-8704-00600893B1BD} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicComposer\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D30BCC65-60E8-11D1-A7CE-00A0C913F73C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D30BCC65-60E8-11D1-A7CE-00A0C913F73C}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicSignPostTrack\ = "DirectMusicSignPostTrack" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicSignPostTrack.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicTemplate\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicTemplate\CurVer\ = "Microsoft.DirectMusicTemplate.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2AC2896-B39B-11D1-8704-00600893B1BD}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicChordMapTrack.1\ = "DirectMusicChordMapTrack" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2AC288F-B39B-11D1-8704-00600893B1BD}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicChordMapTrack.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicChordMap\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicChordMap.1\ = "DirectMusicChordMap" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicComposer\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicSignPostTrack.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicChordMapTrack regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1528 wrote to memory of 4324 1528 regsvr32.exe 84 PID 1528 wrote to memory of 4324 1528 regsvr32.exe 84 PID 1528 wrote to memory of 4324 1528 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8255684b491d8f80568eb60cff51d620N.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\8255684b491d8f80568eb60cff51d620N.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4324
-