Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 11:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20fa96447b94dd37ca2898a6a371332b3cddf6f4fdabd5662996da82ed208db5.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
20fa96447b94dd37ca2898a6a371332b3cddf6f4fdabd5662996da82ed208db5.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 20fa96447b94dd37ca2898a6a371332b3cddf6f4fdabd5662996da82ed208db5.dll
- Size 136KB
- Sample260730-nyj2aagh24
- SHA256 20fa96447b94dd37ca2898a6a371332b3cddf6f4fdabd5662996da82ed208db5
- MD5 451b0be413ffd8956e10d552d9097f9b
- SHA1 d41aaf58ea8f083e8f70d701b8d7116cd7979813
- SHA512 b15a158dd6157a83965c189bac3e5eb001749184612e3b1719ee31eb38f5a0b8229442f13152c049996c14c925ac00c752c6893b177bfb851d0ee149e73f4db1
- SSDEEP 1536:koMqckiXQzrWv790RFQstxBvAY6vT7HsYpaMFTOMwnAK9fnNojwRomP8Gh:FMqckSJ7WR+vEWaMm9/NojwRNZh
- TLSH T146D37C2172E2C4B7E18A0039A9649FBAD37ABF398C745443AB503F1D3FB1994D91960A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 27 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0CC28F2-D044-4B4C-B815-C7EFF7F40B0A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0CC28F2-D044-4B4C-B815-C7EFF7F40B0A}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0CC28F2-D044-4B4C-B815-C7EFF7F40B0A}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0CC28F2-D044-4B4C-B815-C7EFF7F40B0A}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBZFiSLTranShare.ZFiSLTranSharecoms.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBZFiSLTranShare.ZFiSLTranSharecoms.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBZFiSLTranShare.ZFiSLTranSharecoms regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBZFiSLTranShare.ZFiSLTranSharecoms\CLSID\ = "{1BF8AB45-4D6F-4950-B629-03359B8FAC0A}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0CC28F2-D044-4B4C-B815-C7EFF7F40B0A}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0CC28F2-D044-4B4C-B815-C7EFF7F40B0A}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\20fa96447b94dd37ca2898a6a371332b3cddf6f4fdabd5662996da82ed208db5.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0CC28F2-D044-4B4C-B815-C7EFF7F40B0A}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BF8AB45-4D6F-4950-B629-03359B8FAC0A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BF8AB45-4D6F-4950-B629-03359B8FAC0A}\ = "ZFiSLTranSharecoms Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BF8AB45-4D6F-4950-B629-03359B8FAC0A}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BF8AB45-4D6F-4950-B629-03359B8FAC0A}\VersionIndependentProgID\ = "KDGBZFiSLTranShare.ZFiSLTranSharecoms" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BF8AB45-4D6F-4950-B629-03359B8FAC0A}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0CC28F2-D044-4B4C-B815-C7EFF7F40B0A}\1.0\ = "KDGBZFiSLTranShare 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0CC28F2-D044-4B4C-B815-C7EFF7F40B0A}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBZFiSLTranShare.ZFiSLTranSharecoms.1\ = "ZFiSLTranSharecoms Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBZFiSLTranShare.ZFiSLTranSharecoms.1\CLSID\ = "{1BF8AB45-4D6F-4950-B629-03359B8FAC0A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBZFiSLTranShare.ZFiSLTranSharecoms\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BF8AB45-4D6F-4950-B629-03359B8FAC0A}\ProgID\ = "KDGBZFiSLTranShare.ZFiSLTranSharecoms.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BF8AB45-4D6F-4950-B629-03359B8FAC0A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\20fa96447b94dd37ca2898a6a371332b3cddf6f4fdabd5662996da82ed208db5.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0CC28F2-D044-4B4C-B815-C7EFF7F40B0A}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBZFiSLTranShare.ZFiSLTranSharecoms\ = "ZFiSLTranSharecoms Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BF8AB45-4D6F-4950-B629-03359B8FAC0A}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BF8AB45-4D6F-4950-B629-03359B8FAC0A}\InprocServer32\ThreadingModel = "both" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 924 wrote to memory of 5160 924 regsvr32.exe 89
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\20fa96447b94dd37ca2898a6a371332b3cddf6f4fdabd5662996da82ed208db5.dll1⤵
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\20fa96447b94dd37ca2898a6a371332b3cddf6f4fdabd5662996da82ed208db5.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5160
-