4599f5d504c127f7e2ee391f06725461b9b761492c72ac2eb98f2429f04ef5c1

Analysis

max time kernel
90s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2024 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

axvlc.dll
Size

1.3MB
MD5

c0b8ab309a87b39e2b0be5e9b03b1d4b
SHA1

c21eead8cd6746c5d40ae819b50f63f116103891
SHA256

a08fcfc025ef973d05b86a424054f81a9658d160b8fae7ec2d1df940a1200a14
SHA512

d96256ed17594e2eca35c3c8e155242f4903b170ceebfefe1123f8c67b72a187f617c4614623d0222182c62faffebf1fc6d9425a9b21aec57b3c3f46a57c07bd
SSDEEP

24576:oszAWSjtzgHLFftz1gRthRsvBeAWHFusccYvgraBOe:oJ/zgHy4BeAWHt7e

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 47 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.2\CLSID\ = "{9BE31822-FDAD-461B-AD51-BE1D1C159921}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin\CurVer\ = "VideoLAN.VLCPlugin.2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.2\ = "VLC ActiveX Plugin and IE Web Plugin v2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-vlc-plugin\CLSID = "{9BE31822-FDAD-461B-AD51-BE1D1C159921}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\axvlc.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin\CLSID\ = "{9BE31822-FDAD-461B-AD51-BE1D1C159921}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-vlc-plugin\ = "VLC ActiveX Plugin and IE Web Plugin v2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\MiscStatus\1\ = "131473"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin\ = "VLC ActiveX Plugin and IE Web Plugin v2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-vlc-plugin	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\ = "VLC ActiveX Plugin and IE Web Plugin v2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\Version\ = "1.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-vlc-plugin	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.2	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\ProgID\ = "VideoLAN.VLCPlugin.2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\TypeLib\ = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\Implemented Categories\{0DE86A58-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.2\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DF2BBE39-40A8-433B-A279-073F48DA94B6}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DF2BBE39-40A8-433B-A279-073F48DA94B6}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\axvlc.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\VersionIndependentProgID\ = "VideoLAN.VLCPlugin"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\axvlc.dll,1"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2816	2500	regsvr32.exe	85
PID 2500 wrote to memory of 2816	2500	regsvr32.exe	85
PID 2500 wrote to memory of 2816	2500	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\axvlc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\axvlc.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads