Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 10:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0348f39de0fad257ef36aa478a95fb48bb5bdb520aff8ec95b363cbac4e8c67d.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0348f39de0fad257ef36aa478a95fb48bb5bdb520aff8ec95b363cbac4e8c67d.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 0348f39de0fad257ef36aa478a95fb48bb5bdb520aff8ec95b363cbac4e8c67d.dll
- Size 3.0MB
- Sample260722-mj1vtatanf
- SHA256 0348f39de0fad257ef36aa478a95fb48bb5bdb520aff8ec95b363cbac4e8c67d
- MD5 0a407a335bc09611c9ec2647bda6f6fa
- SHA1 f1393be8f12dd9cdfa6c473eea8e51946cf8a11c
- SHA512 8b7cc6ad05b1578306e7cd332be9737faa508074b799cbe0a2e5af16a1e877d70cf307248a6cd151185b3e86c7d3fdc394898b70ee8fa098133799d16ef47fb0
- SSDEEP 49152:8GnNd48vnGnfevbotse/aAyAEU+J69Nvfm6lx50i6Rm2vGaCJQx:BnLNeseS767vp5Qs2v3CCx
- TLSH T1CEE57CE27A4289B1D999237035A59B3547FBBC220470A347D7CBB12E5F71381E227BB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies system executable filetype association 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\LittlePicture\ = "{36A479FC-5412-4163-80BA-74D86A96A9BC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\LittlePicture regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\LittlePicture\ = "{36A479FC-5412-4163-80BA-74D86A96A9BC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\LittlePicture regsvr32.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 31 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\LittlePicture regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\LittlePicture\ = "{36A479FC-5412-4163-80BA-74D86A96A9BC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\* regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\LittlePicture regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\LittlePicture\ = "{36A479FC-5412-4163-80BA-74D86A96A9BC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\LittlePicture\ = "{36A479FC-5412-4163-80BA-74D86A96A9BC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\LittlePicture\ = "{36A479FC-5412-4163-80BA-74D86A96A9BC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\LittlePicture\ = "{36A479FC-5412-4163-80BA-74D86A96A9BC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36A479FC-5412-4163-80BA-74D86A96A9BC}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\LittlePicture regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\LittlePicture regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\LittlePicture regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36A479FC-5412-4163-80BA-74D86A96A9BC} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36A479FC-5412-4163-80BA-74D86A96A9BC}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36A479FC-5412-4163-80BA-74D86A96A9BC}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0348f39de0fad257ef36aa478a95fb48bb5bdb520aff8ec95b363cbac4e8c67d.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\DragDropHandlers\LittlePicture\ = "{36A479FC-5412-4163-80BA-74D86A96A9BC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36A479FC-5412-4163-80BA-74D86A96A9BC}\ = "Little KANTU Shell Extension" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\DragDropHandlers regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\LittlePicture\ = "{36A479FC-5412-4163-80BA-74D86A96A9BC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\LittlePicture\ = "{36A479FC-5412-4163-80BA-74D86A96A9BC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\LittlePicture\ = "{36A479FC-5412-4163-80BA-74D86A96A9BC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\DragDropHandlers\LittlePicture regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\LittlePicture regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\LittlePicture\ = "{36A479FC-5412-4163-80BA-74D86A96A9BC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\LittlePicture regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\LittlePicture regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\LittlePicture regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5888 wrote to memory of 1404 5888 regsvr32.exe 88
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0348f39de0fad257ef36aa478a95fb48bb5bdb520aff8ec95b363cbac4e8c67d.dll1⤵
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0348f39de0fad257ef36aa478a95fb48bb5bdb520aff8ec95b363cbac4e8c67d.dll2⤵
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1404
-