26ac1b09a3ad625ccb25946b2e13437215f7ef80a73281104d2a1be87a17c09a

Analysis

max time kernel
133s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2024 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Filters/Ogg/OggDS.dll
Size

232KB
MD5

ac39539f25c253bbfdcc73ab0a771b51
SHA1

85afe926c22610c26a001f8a1bbfa948e6d9c2d6
SHA256

7281674cb4e3964743e3859f0d02c43bef4f276e9f0f18d316dd6ace6d156a64
SHA512

92f1d92cfee4b7b827907895e70c5dd2c160e8a7a1003bd8dcd65e6ccab6f5c5a5bd30a76353980b5639b7b15c14036e9d1a756081b6bc85462ceb7e5e0b706b
SSDEEP

3072:ZF5u2Qed31Q+S36ShY5X509bPSw9/jiQ4n/u0T01gAg0FuPyAsjjVCDIi:YB16mY5Ot/ji/nbwqAOPKq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

regsvr32.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{078C3DAA-9E58-4D42-9E1C-7C8EE79539C5}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB97AFC3-D08E-4E2D-98E0-AEE6D4634BA4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\Ogg\\OggDS.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02391F44-2767-4E6A-A484-9B47B506F3A4}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77983549-FFDA-4A88-B48F-B924E8D1F01C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\Ogg\\OggDS.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{8CAE96B7-85B1-4605-B23C-17FF5262B296}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33D9A761-90C8-11d0-BD43-00A0C911CE86}\Instance\Vorbis Encoder	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.ogg	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.ogg\Media Type = "{E436EB83-524F-11CE-9F53-0020AF0BA770}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F07E245F-5A1F-4D1E-8BFF-DC31D84A55AB}\ = "Ogg Splitter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02391F44-2767-4E6A-A484-9B47B506F3A4}\ = "Vorbis Decoder"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{915E0060-918C-4A02-A585-1B912BA71CEE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F07E245F-5A1F-4D1E-8BFF-DC31D84A55AB}\CLSID = "{F07E245F-5A1F-4D1E-8BFF-DC31D84A55AB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33D9A761-90C8-11d0-BD43-00A0C911CE86}\Instance\Vorbis Encoder\CLSID = "{889EF574-0656-4B52-9091-072E52BB1B80}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\.ogg\ = "Ogg File (*.ogg)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02391F44-2767-4E6A-A484-9B47B506F3A4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{889EF574-0656-4B52-9091-072E52BB1B80}\CLSID = "{889EF574-0656-4B52-9091-072E52BB1B80}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ogg\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}\ = "{c5a40261-cd64-4ccf-84cb-c394da41d590}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{078C3DAA-9E58-4D42-9E1C-7C8EE79539C5}\ = "Ogg Splitter property page"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{078C3DAA-9E58-4D42-9E1C-7C8EE79539C5}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\Ogg\\OggDS.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{889EF574-0656-4B52-9091-072E52BB1B80}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C5379125-FD36-4277-A7CD-FAB469EF3A2F}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77983549-FFDA-4A88-B48F-B924E8D1F01C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{8CAE96B7-85B1-4605-B23C-17FF5262B296}\FriendlyName = "Ogg Multiplexer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ogm\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}\ = "{c5a40261-cd64-4ccf-84cb-c394da41d590}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F07E245F-5A1F-4D1E-8BFF-DC31D84A55AB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C5379125-FD36-4277-A7CD-FAB469EF3A2F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C5379125-FD36-4277-A7CD-FAB469EF3A2F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\Ogg\\OggDS.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{02391F44-2767-4E6A-A484-9B47B506F3A4}\CLSID = "{02391F44-2767-4E6A-A484-9B47B506F3A4}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.ogg\Source Filter = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ogg\ShellEx	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ogg\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F07E245F-5A1F-4D1E-8BFF-DC31D84A55AB}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CAE96B7-85B1-4605-B23C-17FF5262B296}\ = "Ogg Multiplexer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB97AFC3-D08E-4E2D-98E0-AEE6D4634BA4}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02391F44-2767-4E6A-A484-9B47B506F3A4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\Ogg\\OggDS.dll"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{8CAE96B7-85B1-4605-B23C-17FF5262B296}\FilterData = 020000000000400002000000000000003070693304000000000000000000000000000000000000003170693308000000000000000100000000000000000000003074793300000000500000006000000083eb36e44f52ce119f530020af0ba770a95f85d2a761b04db97971f297c17a04	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{889EF574-0656-4B52-9091-072E52BB1B80}\FriendlyName = "Vorbis Encoder"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{02391F44-2767-4E6A-A484-9B47B506F3A4}\FilterData = 0200000000006000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000800000006175647300001000800000aa00389b71d5a2dccd756d984f840e737bedd5c63b0100000000001000800000aa00389b71	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.ogm\Source Filter = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{078C3DAA-9E58-4D42-9E1C-7C8EE79539C5}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02391F44-2767-4E6A-A484-9B47B506F3A4}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{915E0060-918C-4A02-A585-1B912BA71CEE}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77983549-FFDA-4A88-B48F-B924E8D1F01C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{8CAE96B7-85B1-4605-B23C-17FF5262B296}\CLSID = "{8CAE96B7-85B1-4605-B23C-17FF5262B296}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.ogm\Subtype = "{D2855FA9-61A7-4DB0-B979-71F297C17A04}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F07E245F-5A1F-4D1E-8BFF-DC31D84A55AB}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CAE96B7-85B1-4605-B23C-17FF5262B296}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77983549-FFDA-4A88-B48F-B924E8D1F01C}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33D9A761-90C8-11d0-BD43-00A0C911CE86}\Instance\Vorbis Encoder\FriendlyName = "Vorbis Encoder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{D2855FA9-61A7-4DB0-B979-71F297C17A04}\Source Filter = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ogm\ShellEx	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F07E245F-5A1F-4D1E-8BFF-DC31D84A55AB}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\Ogg\\OggDS.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB97AFC3-D08E-4E2D-98E0-AEE6D4634BA4}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{02391F44-2767-4E6A-A484-9B47B506F3A4}\FriendlyName = "Vorbis Decoder"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\.ogm\ = "Ogg File (*.ogg)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{889EF574-0656-4B52-9091-072E52BB1B80}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{889EF574-0656-4B52-9091-072E52BB1B80}\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000800000006175647300001000800000aa00389b710100000000001000800000aa00389b71d5a2dccd756d984f840e737bedd5c63b	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\Instance\Vorbis Encoder	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33D9A761-90C8-11d0-BD43-00A0C911CE86}\Instance\Vorbis Encoder\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000800000006175647300001000800000aa00389b710100000000001000800000aa00389b71d5a2dccd756d984f840e737bedd5c63b	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{889EF574-0656-4B52-9091-072E52BB1B80}\ = "Vorbis Encoder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C5379125-FD36-4277-A7CD-FAB469EF3A2F}\ = "Vorbis Compressor property page"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{915E0060-918C-4A02-A585-1B912BA71CEE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\Ogg\\OggDS.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	Process	procid_target
PID 3748 wrote to memory of 3300	3748	regsvr32.exe	85
PID 3748 wrote to memory of 3300	3748	regsvr32.exe	85
PID 3748 wrote to memory of 3300	3748	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Filters\Ogg\OggDS.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Filters\Ogg\OggDS.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3300-0-0x00000000009E0000-0x0000000000A10000-memory.dmp

Filesize
192KB

Download
memory/3300-2-0x0000000000900000-0x000000000090C000-memory.dmp

Filesize
48KB

Download
memory/3300-3-0x00000000022C0000-0x00000000023A5000-memory.dmp

Filesize
916KB

Download