b612943bb279cd53d694fde4bde04cca09e71b1e3cb6994714c4486a1f404d88

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b612943bb279cd53d694fde4bde04cca09e71b1e3cb6994714c4486a1f404d88.dll
Size

203KB
MD5

da61d65e4654f51549163ae134140dd7
SHA1

fefd3743cbc49d236d069982b192e0425e3dd460
SHA256

b612943bb279cd53d694fde4bde04cca09e71b1e3cb6994714c4486a1f404d88
SHA512

b5565f741aad62952ae96c579079995d82e633055f1a537f73b78203f2c80e1b623e3b05060b38526cd0a31a69ab6cbb7764acf1501f34eec1cb6f93ab94b71f
SSDEEP

3072:jUGnP9QEuRolQbV7u9Hr4y1GrrT1g5MwhjmK8Lcg1SqfJj1ovUEDlbfc1trUxdxX:jUGPklu9LT1Y6VhmcSBfiSuX

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E799A91-CDDC-471B-A803-2DB82FAFB726}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\Transforms\0e799a91-cddc-471b-a803-2db82fafb726	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\Transforms\0e799a91-cddc-471b-a803-2db82fafb726\Attributes = 41464d490400000015cba788077b344a9128e64c6703c4d313000000000000000800000000000000295ca3ea5e778e489b61b3283e49583b13000000000000000100000000000000116a4753133ffb49ac42ee2733c9674113000000000000000100000000000000ac66b82f78b04249ab6c003d05cda6741f000000000000001c0000008800000041004d0044004d00460054004400650063006f006400650072000000	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\Transforms\0e799a91-cddc-471b-a803-2db82fafb726\MFTFlags = "4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\Transforms\Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E799A91-CDDC-471B-A803-2DB82FAFB726}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E799A91-CDDC-471B-A803-2DB82FAFB726}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E799A91-CDDC-471B-A803-2DB82FAFB726}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b612943bb279cd53d694fde4bde04cca09e71b1e3cb6994714c4486a1f404d88.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\Transforms\Categories\d6c02d4b-6833-45b4-971a-05a4b04bab91	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\Transforms\Categories\d6c02d4b-6833-45b4-971a-05a4b04bab91\0e799a91-cddc-471b-a803-2db82fafb726	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\Transforms	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E799A91-CDDC-471B-A803-2DB82FAFB726}\ = "AMD Playback Decoder MFT"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\Transforms\0e799a91-cddc-471b-a803-2db82fafb726\InputTypes = 7669647300001000800000aa00389b71574d563300001000800000aa00389b717669647300001000800000aa00389b715756433100001000800000aa00389b71	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E799A91-CDDC-471B-A803-2DB82FAFB726}\Merit = "8"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\Transforms\0e799a91-cddc-471b-a803-2db82fafb726\ = "AMD Playback Decoder MFT"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\MediaFoundation\Transforms\0e799a91-cddc-471b-a803-2db82fafb726\OutputTypes = 7669647300001000800000aa00389b714e56313200001000800000aa00389b717669647300001000800000aa00389b715956313200001000800000aa00389b717669647300001000800000aa00389b715955593200001000800000aa00389b71	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1980	1172	regsvr32.exe	31
PID 1172 wrote to memory of 1980	1172	regsvr32.exe	31
PID 1172 wrote to memory of 1980	1172	regsvr32.exe	31
PID 1172 wrote to memory of 1980	1172	regsvr32.exe	31
PID 1172 wrote to memory of 1980	1172	regsvr32.exe	31
PID 1172 wrote to memory of 1980	1172	regsvr32.exe	31
PID 1172 wrote to memory of 1980	1172	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b612943bb279cd53d694fde4bde04cca09e71b1e3cb6994714c4486a1f404d88.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b612943bb279cd53d694fde4bde04cca09e71b1e3cb6994714c4486a1f404d88.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...