Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/04/2026, 12:10
Static task
static1
Behavioral task
behavioral1
Sample
bc44766ad8574c285fb5b3ac30a7309b2789c27460947af3278bf57214d760b6.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
bc44766ad8574c285fb5b3ac30a7309b2789c27460947af3278bf57214d760b6.dll
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target bc44766ad8574c285fb5b3ac30a7309b2789c27460947af3278bf57214d760b6.dll
- Size 456KB
- Sample260418-pb8a2agz91
- SHA256 bc44766ad8574c285fb5b3ac30a7309b2789c27460947af3278bf57214d760b6
- MD5 62283bc0a322a9c7caaa3ef98c40b53d
- SHA1 8e0c0f063db554554400c0aa3fa5df974d37f998
- SHA512 b7d9383c0fff7b3bac43e2e0d7d0ad7e8a71c97e1918b207898b5c87b0cd0ec3253ca411ddf889840c6022a511f1b16606a893dd91be899404b98cf05a1036de
- SSDEEP 12288:JdfKe8wdTwPfvKGARJ+AwWJxu5vR+gYKsFHzr:JdfKe8QTwPfvlAFu5vR+DKs1zr
- TLSH T139A459217946C133D67E0770266E8A6B84BE3A718FB944CBB7DC4E2E5B708C21635D27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Modifies system executable filetype association 2 TTPs 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\HaoZip regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\HaoZip\ = "{5FED836A-C96C-4d88-A91E-F63F07726585}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\HaoZip regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\HaoZip regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\HaoZip regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\HaoZip\ = "{5FED836A-C96C-4d88-A91E-F63F07726585}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers regsvr32.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\PropertySheetHandlers\HaoZip regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\DragDropHandlers\HaoZip regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\HaoZip regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\HaoZip regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5FED836A-C96C-4d88-A91E-F63F07726585}\ = "HaoZip Shell Extension" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5FED836A-C96C-4d88-A91E-F63F07726585}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5FED836A-C96C-4d88-A91E-F63F07726585}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\HaoZip regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\HaoZip regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\HaoZip regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\DragDropHandlers\HaoZip\ = "{5FED836A-C96C-4d88-A91E-F63F07726585}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\HaoZip regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\HaoZip regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\HaoZip\ = "{5FED836A-C96C-4d88-A91E-F63F07726585}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5FED836A-C96C-4d88-A91E-F63F07726585}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bc44766ad8574c285fb5b3ac30a7309b2789c27460947af3278bf57214d760b6.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\PropertySheetHandlers\HaoZip\ = "{5FED836A-C96C-4d88-A91E-F63F07726585}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\HaoZip\ = "{5FED836A-C96C-4d88-A91E-F63F07726585}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\HaoZip regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\HaoZip regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\HaoZip\ = "{5FED836A-C96C-4d88-A91E-F63F07726585}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\HaoZip\ = "{5FED836A-C96C-4d88-A91E-F63F07726585}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\HaoZip\ = "{5FED836A-C96C-4d88-A91E-F63F07726585}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\HaoZip regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\HaoZip\ = "{5FED836A-C96C-4d88-A91E-F63F07726585}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\DragDropHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\HaoZip regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\HaoZip regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\PropertySheetHandlers\HaoZip regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\HaoZip regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\HaoZip regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5FED836A-C96C-4d88-A91E-F63F07726585} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\HaoZip\ = "{5FED836A-C96C-4d88-A91E-F63F07726585}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\HaoZip regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\DragDropHandlers\HaoZip regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\HaoZip regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\HaoZip regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\HaoZip\ = "{5FED836A-C96C-4d88-A91E-F63F07726585}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\HaoZip regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\HaoZip\ = "{5FED836A-C96C-4d88-A91E-F63F07726585}" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4540 wrote to memory of 3836 4540 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\bc44766ad8574c285fb5b3ac30a7309b2789c27460947af3278bf57214d760b6.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\bc44766ad8574c285fb5b3ac30a7309b2789c27460947af3278bf57214d760b6.dll2⤵
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3836
-