Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 14:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
45535b3c2ecb3c35390193a1fa2e0bfaf0db5f3c9d9208a6401f0b05599f375d.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
45535b3c2ecb3c35390193a1fa2e0bfaf0db5f3c9d9208a6401f0b05599f375d.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 45535b3c2ecb3c35390193a1fa2e0bfaf0db5f3c9d9208a6401f0b05599f375d.dll
- Size 278KB
- Sample261003-schcsasyaz
- SHA256 45535b3c2ecb3c35390193a1fa2e0bfaf0db5f3c9d9208a6401f0b05599f375d
- MD5 3d930187ad62cc133cb85572716559b1
- SHA1 016acde638db45ad6ad322ce631ae39352a8154e
- SHA512 df115af54a479aaf4ebb1feca20b3d9d63620eda3f55f7372b0f151d75d960aa7c09641df5ce40f00a6b3a89c4073ec22e0d99eb8f4f862eefb0dfcc757549a1
- SSDEEP 6144:gC7dOYY4mr0cU4zS8yboeUiUvy6nS3AKeLAvIAW34lr7L1MOTgVWY10nSaplJqFC:r7q4mr0cU4zS8yboHTe1IAW34lr7L1M+
- TLSH T1AF54F706EEE5DB33E9F7AA7444A7526A1832FC045B30D64FA70E904A0B317249F91F76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies system executable filetype association 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\PropertySheetHandlers\Property regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\PropertySheetHandlers\Page regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\Page regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\Property regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\Page\ = "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\lnkfile\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers\Property regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\PropertySheetHandlers\Page\ = "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\PropertySheetHandlers\Page\ = "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers\ShimLayer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers\Page\ = "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\PropertySheetHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\PropertySheetHandlers\Property regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\PropertySheetHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\PropertySheetHandlers\ShimLayer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\ShimLayer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers\Page regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\PropertySheetHandlers\ShimLayer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\PropertySheetHandlers\Page regsvr32.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 45 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\Property regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\lnkfile\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers\ShimLayer regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\PropertySheetHandlers\Page\ = "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shellex\PropertySheetHandlers\Page\ = "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\Page\ = "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\lnkfile regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shellex\PropertySheetHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shellex\PropertySheetHandlers\ShimLayer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shellex\PropertySheetHandlers\Property regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers\Property regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\PropertySheetHandlers\Property regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers\Page\ = "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shellex\PropertySheetHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\PropertySheetHandlers regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\PropertySheetHandlers\Page\ = "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\ShimLayer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\Page regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers\Page regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shellex\PropertySheetHandlers\ShimLayer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shellex\PropertySheetHandlers\Property regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\PropertySheetHandlers\Property regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\PropertySheetHandlers\Page regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shellex\PropertySheetHandlers\Page regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shellex\PropertySheetHandlers\Page\ = "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\PropertySheetHandlers\ShimLayer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\PropertySheetHandlers\Page regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\PropertySheetHandlers regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\PropertySheetHandlers\ShimLayer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shellex regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shellex\PropertySheetHandlers\Page regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 928 wrote to memory of 4736 928 regsvr32.exe 90
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\45535b3c2ecb3c35390193a1fa2e0bfaf0db5f3c9d9208a6401f0b05599f375d.dll1⤵
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\45535b3c2ecb3c35390193a1fa2e0bfaf0db5f3c9d9208a6401f0b05599f375d.dll2⤵
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4736
-