479d68213f9848ae8a478ba7cdd0454e382763efaa985d770111135224adff37

Analysis

max time kernel
105s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2025, 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

load/blizzard.dll
Size

597KB
MD5

1412eb96aba898d574f2da3cd86c22d1
SHA1

16a9c55cb3fdbc17d5f0b105ab5df6503539182e
SHA256

c0bb58e9ba4ce5d93e059677fffdd1886fa1433226d40c21c0deceb15409911a
SHA512

78ceded9293a4e4d84de17e4ce5b0441a5de85c75c1cd711f4aa2e9498671d419bccc2ca74b4304ba30428dd3979c48c5c0e4c86e96a0c49550d075e955f51cf
SSDEEP

6144:PLuhEgot9zhNi6/IWhkBQf2bQVRDZERQJ7odSsKOuAeA8vBwoDD09K:inot9zhNi6/IWhkBQObIZERQJ7/jyAD5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{307A6C42-0000-0010-8000-00AA00389B71}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\load\\blizzard.dll"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{307A6C42-0000-0010-8000-00AA00389B71}\FilterData = 020000000000800002000000000000003070693300000000000000000200000000000000000000003074793300000000700000008000000031747933000000007000000090000000317069330800000000000000010000000000000000000000307479330000000070000000a00000007669647300001000800000aa00389b71426c7a3000001000800000aa00389b71424c5a3000001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}\Instance	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{307A6C42-0000-0010-8000-00AA00389B71}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{307A6C42-0000-0010-8000-00AA00389B71}\ = "DivX for Blizzard Decoder Filter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{307A6C42-0000-0010-8000-00AA00389B71}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{307A6C42-0000-0010-8000-00AA00389B71}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{307A6C42-0000-0010-8000-00AA00389B71}\FriendlyName = "DivX for Blizzard Decoder Filter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{307A6C42-0000-0010-8000-00AA00389B71}\CLSID = "{307A6C42-0000-0010-8000-00AA00389B71}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}\Instance\CLSID_Blizzard	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{307A6C42-0000-0010-8000-00AA00389B71}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5252 wrote to memory of 3764	5252	regsvr32.exe	85
PID 5252 wrote to memory of 3764	5252	regsvr32.exe	85
PID 5252 wrote to memory of 3764	5252	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\load\blizzard.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5252
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\load\blizzard.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads