Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/04/2026, 04:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e200298313bb8a8578487fbbc5d407efc2a5b377ba1e667ecdd48423548e7dec.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
e200298313bb8a8578487fbbc5d407efc2a5b377ba1e667ecdd48423548e7dec.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target e200298313bb8a8578487fbbc5d407efc2a5b377ba1e667ecdd48423548e7dec.dll
- Size 457KB
- Sample260427-evfp1sev2p
- SHA256 e200298313bb8a8578487fbbc5d407efc2a5b377ba1e667ecdd48423548e7dec
- MD5 4b00c95ad8857a09fb25dafdab883e94
- SHA1 c3a29d93ac0be283395fb8b1237411cd7de2663b
- SHA512 cecb2321efa3ae100f931008fb96876d65f87a86f4260735fcd3c3b4249939ce6c4d341e959de0e5cbf65442f97008de19db44a1aa7cce980896086ae251abf9
- SSDEEP 12288:ruDWNnKD6qU31EXdIgBU+amG7nZYHkngNmr22IXi9GhZ2yVSHlMIDzqiYmgtFdSm:qDWNnKGqQ1EXdIgBU+amG7nZYHkngNmM
- TLSH T1F9A41A25F66384E5D42B0E701AAEF7BF862D7A62C834DD69E70CCA9D2F53970A530311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5CA5F7F-1847-4D87-9C5B-918509F7511D}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A39EE748-6A27-4817-A6F2-13914BEF5890}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\deflate\ = "AP Deflate Encoding/Decoding Filter" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1E50292-A795-4117-8E09-2B560A72AC60}\NumMethods\ = "16" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A39EE748-6A27-4817-A6F2-13914BEF5890}\ = "IUri" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https\ = "https: Asynchronous Pluggable Protocol Handler" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2AD1EDAF-D83D-48B5-9ADF-03DBE19F53BD}\ = "IAuthenticateEx" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5CA5F7F-1847-4D87-9C5B-918509F7511D}\NumMethods\ = "4" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C0-BAF9-11CE-8C82-00AA004BA90B}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "4" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D6-BAFA-11CE-8C82-00AA004BA90B}\ = "IWinInetInfo" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1E50292-A795-4117-8E09-2B560A72AC60}\ = "IInternetSecurityManagerEx2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD45F185-1B21-48E2-967B-EAD743A8914E}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml\ = "AP Deflate Encoding/Decoding Filter" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C0-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml\CLSID = "{8f6b0360-b80d-11d0-a9b3-006097942311}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C0-BAF9-11CE-8C82-00AA004BA90B}\ = "IBinding" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A39EE748-6A27-4817-A6F2-13914BEF5890}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mk\ = "mk: Asynchronous Pluggable Protocol Handler" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2AD1EDAF-D83D-48B5-9ADF-03DBE19F53BD}\NumMethods regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D8-BAFA-11CE-8C82-00AA004BA90B}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D8-BAFA-11CE-8C82-00AA004BA90B}\NumMethods\ = "5" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD45F185-1B21-48E2-967B-EAD743A8914E}\ = "IZoneIdentifier" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\file regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ftp\CLSID = "{79eac9e3-baf9-11ce-8c82-00aa004ba90b}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\gzip\CLSID = "{8f6b0360-b80d-11d0-a9b3-006097942311}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F164EDF1-CC7C-4F0D-9A94-34222625C393}\ = "IInternetSecurityManagerEx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC4801A1-2BA9-11CF-A229-00AA003D7352}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "11" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F6B0360-B80D-11D0-A9B3-006097942311}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C1-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "11" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC4801A1-2BA9-11CF-A229-00AA003D7352}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C9-BAF9-11CE-8C82-00AA004BA90B}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1E50292-A795-4117-8E09-2B560A72AC60}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79EAC9E4-BAF9-11CE-8C82-00AA004BA90B}\ = "gopher: Asynchronous Pluggable Protocol Handler" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\cdl regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\deflate\CLSID = "{8f6b0360-b80d-11d0-a9b3-006097942311}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C9-BAF9-11CE-8C82-00AA004BA90B}\ = "IPersistMoniker" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F6B0360-B80D-11D0-A9B3-006097942311}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\file\ = "file:, local: Asynchronous Pluggable Protocol Handler" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mk regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\mk\CLSID = "{79eac9e6-baf9-11ce-8c82-00aa004ba90b}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C1-BAF9-11CE-8C82-00AA004BA90B}\ = "IBindStatusCallback" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5CA5F7F-1847-4D87-9C5B-918509F7511D}\ = "IMonikerProp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F164EDF1-CC7C-4F0D-9A94-34222625C393}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD45F185-1B21-48E2-967B-EAD743A8914E}\NumMethods\ = "6" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F6B0360-B80D-11D0-A9B3-006097942311}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e200298313bb8a8578487fbbc5d407efc2a5b377ba1e667ecdd48423548e7dec.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local\ = "file:, local: Asynchronous Pluggable Protocol Handler" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http\ = "http: Asynchronous Pluggable Protocol Handler" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAA74EF9-8EE7-4659-88D9-F8C504DA73CC}\ = "IBindStatusCallbackEx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F9F9FCB-E0F4-48EB-B7AB-FA2EA9365CB4}\NumMethods regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAA74EF9-8EE7-4659-88D9-F8C504DA73CC}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F6B0360-B80D-11D0-A9B3-006097942311} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http\CLSID = "{79eac9e2-baf9-11ce-8c82-00aa004ba90b}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2AD1EDAF-D83D-48B5-9ADF-03DBE19F53BD}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local\CLSID = "{79eac9e7-baf9-11ce-8c82-00aa004ba90b}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2AD1EDAF-D83D-48B5-9ADF-03DBE19F53BD}\NumMethods\ = "5" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D8-BAFA-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}\ = "IInternetSecurityManager" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\gopher\ = "gopher: Asynchronous Pluggable Protocol Handler" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4956 wrote to memory of 4604 4956 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e200298313bb8a8578487fbbc5d407efc2a5b377ba1e667ecdd48423548e7dec.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e200298313bb8a8578487fbbc5d407efc2a5b377ba1e667ecdd48423548e7dec.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4604
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\RGI44E4.tmp
- Size 19KB
- SHA256 d3492df7e6f6cd369404a5c69bb958b2744367e729de5ef2a6729c37d7a0d940
- MD5 50dcdfa8e48ed7084e739f53f7ed239e
- SHA1 ecd0fde5ad093772cc69a130d534a44126765617
- SHA512 189bf0a0fcadf88f8d55446e2fb581ea05afecacc4132943846c817b37206e2cfe63c05d3d12a715ad6c7dfa0bad93be1bdd86ee81a53847e7f17956685f8378
- SSDEEP 384:XY/qNHA2BtKwX+9+6Z9Z6L9L6bMZ9Z6P9P6+9+67976k9k6o9o6L9L60906zkO9F:YYA7WJ/76ljYGZNyRuWJdiYIUH+RlKY0
- TLSH T174924239A068EF0DA00F3229629F3061F1DC28F9D15CFD6669DFA7BB5D88D494072786
- MD5 SHA1 SHA512 SSDEEP TLSH