Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/03/2025, 21:33

General

  • Target

    242940.ocx.dll

  • Size

    2.2MB

  • MD5

    ccdd5e4104d5aa3503a8fa9ef1455241

  • SHA1

    b0ac2201c86823c175ec532d472a41afbab887a0

  • SHA256

    828eee78537e49b46e34a754306ccf67f6281b77e5caeaf53132a32b6b708e5c

  • SHA512

    1f39f7341a2a9e938d1742e3a2bb9ec663fb226f4a93aad5a3fdaf68e803eef4a39594d159e2d96bf23c733c27dad85d13fb92e60164721a34fa5920681f8da2

  • SSDEEP

    49152:wEMcIDsq2EKwnQXvoXcUiEMxv/VqeXqXcL/CK+:+w8cUiEMxv/VqekOR

Score
6/10

Malware Config

Signatures

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\242940.ocx.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1724

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Packages\Bay0NsQIzx\output.zip

          Filesize

          149B

          MD5

          3b70edb0bd69254e723686d5274f0d1d

          SHA1

          a29b36ca33226e90a08c0454451292255d8abd13

          SHA256

          1344b2fa1cd6247c6d104e2c8829ca840ee2fd17576863066ec25c79c9c0bf64

          SHA512

          e81722a12b637321360a0b941e405e5497925694020c56ac9f00837cc27c6f109e090c05e2f2335a8f8b91f40b492804cc896e773e86c81a683ade477b33f59d

        • C:\Users\Admin\AppData\Local\Packages\Bay0NsQIzx\p.txt

          Filesize

          41B

          MD5

          b8aa163f92ac37168e27450c65f8604f

          SHA1

          eb18995210567d33e1e475153a85dd45358ac9bb

          SHA256

          c5d67bf8fa51748f8baac8a9cef6463e6e5852272bb58af29c429c0ae36a7380

          SHA512

          e987f442230b5c45e1767e42938be47413011c29831cf2b031c258619034926aff5ab3efbaeda8ab91e05514021f17ca15ab9be1f73cda86dbbddf056c2b8ae6