Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/08/2026, 04:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cf299b8f984480e574240059cba6fe86b8dcc3ada66b17c62f58392c9324abb5.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
cf299b8f984480e574240059cba6fe86b8dcc3ada66b17c62f58392c9324abb5.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target cf299b8f984480e574240059cba6fe86b8dcc3ada66b17c62f58392c9324abb5.dll
- Size 1.4MB
- Sample260811-e6a9nswbnf
- SHA256 cf299b8f984480e574240059cba6fe86b8dcc3ada66b17c62f58392c9324abb5
- MD5 40d9e11f46961d8b1287ed0dd64401fc
- SHA1 5350023d98edef4a1d6160a5ec107c4f176700ef
- SHA512 643ba0efcee59de5d406d9e0d7c87ca817bf9a896e3cdc191cc3c000c8d54e265db0730ef70ea825ddc843bfd8e039df7eafa0bb051284fa84780e8ceaa7d4b9
- SSDEEP 24576:0kYZn9o37o0T9lKK/DpQRy9O4E2HSx0blnxyvdu1mdu3FfP6Bft08ky0Pbmpx0nP:Un9cQYEQggJSofEgSsj8Rt1K
- TLSH T1AE659213B661462FF1C58438635BE2A665192E37260DD16FF3809F6C2136AE2F77A703
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF852819-5ACE-4610-9B87-D331F2BAF99E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CCCD5E5B-891A-429E-BF98-2C229105848F}\ = "clsMID214" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B5A5EBE-5960-4CE7-94EA-560D3B228192} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EEC62C6-D9A2-4BF6-89D6-14E30E49D9DB}\TypeLib\Version = "12.3" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B80C1E1B-74B6-4EB6-9871-B85A3DCCBCD6}\TypeLib\Version = "12.3" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{579464BE-5FD1-4A98-8B73-93BC44FC460D}\TypeLib\ = "{E23F31AC-906A-4F48-8AB6-76CD4499C1AF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CDB5957-E592-4C89-8D7C-3228F7AA47B2} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92B4ED14-2FB9-49C6-B205-0922A78C1F4A}\VERSION regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F2FFD64F-A767-47C3-8D19-A6D5CBF1B98A}\ = "_clsMVT11" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MG_Mmt11.clsMaterialPropertiesT\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MG_Mmt11.clsSteelSpecsSection\Clsid\ = "{5021B387-C3ED-4604-ABDD-2B6C97576F24}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C8172D6-7288-4FA6-9FF7-2E814AD32334}\TypeLib\ = "{E23F31AC-906A-4F48-8AB6-76CD4499C1AF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F56EEC5-6E8A-4A87-8CB0-5EEE9AF1A7A3}\VERSION\ = "18.3" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F56EEC5-6E8A-4A87-8CB0-5EEE9AF1A7A3}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AE809B25-2713-4113-B1A3-1758B46C16F5}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D9019A3-E384-46A3-8173-07A7A844E584}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MG_Mmt11.clsMID213\ = "MG_Mmt11.clsMID213" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265BB447-B0AF-4641-BBC3-05ADAC29D02E}\TypeLib\ = "{E23F31AC-906A-4F48-8AB6-76CD4499C1AF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B01FF65-57E7-4D5D-A307-0C6A3D306147}\ = "clsCq11" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69DA2EDB-5F33-459E-A6D4-87D53365C88F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C00F83D-A12E-4426-8D94-AC157CDFB48E}\ = "clsMoment11" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6E0DD63E-A03C-40F6-93AE-27D6A77E631E}\TypeLib\Version = "12.3" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248292B3-5C8C-47DD-877E-8E2088E10027}\ProgID\ = "MG_Mmt11.clsMID212" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E499E064-FB62-4300-8209-1A7817037CA8}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23DA95E5-9F62-4982-8172-B1ECDC2BFF5A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6F56EEC5-6E8A-4A87-8CB0-5EEE9AF1A7A3}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5021B387-C3ED-4604-ABDD-2B6C97576F24}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C8172D6-7288-4FA6-9FF7-2E814AD32334}\ = "clsMID211" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MG_Mmt11.clsMVT16\Clsid\ = "{1B7B2D99-C734-4581-B44B-5E188A7B1CF2}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B80C1E1B-74B6-4EB6-9871-B85A3DCCBCD6}\TypeLib\ = "{E23F31AC-906A-4F48-8AB6-76CD4499C1AF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DD4D7FE-2CEB-4EEB-BF45-CB98EB59A4A6}\TypeLib\ = "{E23F31AC-906A-4F48-8AB6-76CD4499C1AF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MG_Mmt11.clsFormCrackWidth23 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{04A8D499-AC90-4BA1-89CF-A81672267177}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{52D33CBB-88B3-4C8F-B60D-72C649B35A7D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FF2598AE-9F84-4000-A29B-713638069AAC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MG_Mmt11.clsMID260 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CDB5957-E592-4C89-8D7C-3228F7AA47B2}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MG_Mmt11.clsMVT11\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94766F41-F285-4E44-816A-924A5037237F}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MG_Mmt11.clsVn11\ = "MG_Mmt11.clsVn11" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C00F83D-A12E-4426-8D94-AC157CDFB48E}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D3D62E3E-F536-4AE2-83D8-EF4D23E145C1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{32E01D43-538F-4416-AB1C-EEBE15CEBFC8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MG_Mmt11.clsMID213 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31B4316C-FF67-4AAC-A439-973FC1E05EE9}\TypeLib\Version = "12.3" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20D859E4-2382-4DEE-ABB3-CB559A02B760}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C337FAFE-F734-487E-996E-F431D35FFE03}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C337FAFE-F734-487E-996E-F431D35FFE03}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A379971-B4DF-496C-A0D0-D93D05060AF6}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MG_Mmt11.clsMID258\Clsid\ = "{C3A9970E-0E1B-494C-91DD-B01266EA0EFE}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B979B131-4BF5-45DF-8AA9-E3C2E2B7F1C4}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MG_Mmt11.clsFormCqPf regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F2FFD64F-A767-47C3-8D19-A6D5CBF1B98A}\TypeLib\Version = "12.3" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{23DA95E5-9F62-4982-8172-B1ECDC2BFF5A}\TypeLib\Version = "12.3" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MG_Mmt11.clsFormDeflection regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2D9019A3-E384-46A3-8173-07A7A844E584}\ProgID\ = "MG_Mmt11.clsMVT11" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B5A5EBE-5960-4CE7-94EA-560D3B228192}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FF2598AE-9F84-4000-A29B-713638069AAC}\TypeLib\Version = "12.3" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248292B3-5C8C-47DD-877E-8E2088E10027}\ = "MG_Mmt11.clsMID212" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248292B3-5C8C-47DD-877E-8E2088E10027}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5021B387-C3ED-4604-ABDD-2B6C97576F24}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B01FF65-57E7-4D5D-A307-0C6A3D306147}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EEC62C6-D9A2-4BF6-89D6-14E30E49D9DB}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{73086C2D-2965-4865-9D6F-EAAAAB2D6CF0} regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1452 wrote to memory of 3068 1452 regsvr32.exe 85
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\cf299b8f984480e574240059cba6fe86b8dcc3ada66b17c62f58392c9324abb5.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\cf299b8f984480e574240059cba6fe86b8dcc3ada66b17c62f58392c9324abb5.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3068
-