Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 06:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8d303beba3c0c06293966bb7e5e79a6295b494ec9f979744b9335b5cd471a5bb.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
8d303beba3c0c06293966bb7e5e79a6295b494ec9f979744b9335b5cd471a5bb.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 8d303beba3c0c06293966bb7e5e79a6295b494ec9f979744b9335b5cd471a5bb.dll
- Size 1.4MB
- Sample261027-hdvdmach42
- SHA256 8d303beba3c0c06293966bb7e5e79a6295b494ec9f979744b9335b5cd471a5bb
- MD5 d08d141111a53ed44defa42009edb251
- SHA1 c380e1880ec4a2d27d9153ced3207ef0ca3c1949
- SHA512 4829ec4ade11c35c601d86d87aa95406d31afed2cf57fe4602fec095cec03d562e2c7424872136f206b13d09e10bf2e1fc8b0d4e61c86a98ca22c62fa7fcbbfa
- SSDEEP 24576:u22AXfhcTy3pknYrHPM4ZSxfExQjURJ3pB8HhBsi:RxcTy3vXZ2szz8Hsi
- TLSH T1D0659D12BB81C072E59F1275917E97BE5B39AA31072481C3E7C02D699E713E27A3D387
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B6E5CF2-6420-41EA-8DFE-0736CBD6D51F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B6E5CF2-6420-41EA-8DFE-0736CBD6D51F}\TypeLib\ = "{DCB52E86-3605-424A-8FDA-C28CD550B55A}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9C04FC3-13FD-4FF5-9957-42DE9E82B43F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9C04FC3-13FD-4FF5-9957-42DE9E82B43F}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA9A7BFF-908F-4E76-A25D-C839DA813D03}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA9A7BFF-908F-4E76-A25D-C839DA813D03}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA9A7BFF-908F-4E76-A25D-C839DA813D03}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9C04FC3-13FD-4FF5-9957-42DE9E82B43F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DCB52E86-3605-424A-8FDA-C28CD550B55A}\1.0\ = "Evidence ActiveX ¿Ø¼þÄ£¿é" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DCB52E86-3605-424A-8FDA-C28CD550B55A}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B6E5CF2-6420-41EA-8DFE-0736CBD6D51F}\ = "_DEvidence" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B6E5CF2-6420-41EA-8DFE-0736CBD6D51F}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B6E5CF2-6420-41EA-8DFE-0736CBD6D51F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B6E5CF2-6420-41EA-8DFE-0736CBD6D51F}\ = "_DEvidence" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DCB52E86-3605-424A-8FDA-C28CD550B55A}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D43AC0E-BC61-441D-9371-51BE5BB92F89} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D43AC0E-BC61-441D-9371-51BE5BB92F89}\ = "Evidence Property Page" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EVIDENCE.EvidenceCtrl.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA9A7BFF-908F-4E76-A25D-C839DA813D03}\MiscStatus regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA9A7BFF-908F-4E76-A25D-C839DA813D03}\MiscStatus\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA9A7BFF-908F-4E76-A25D-C839DA813D03}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8D303B~1.DLL, 1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA9A7BFF-908F-4E76-A25D-C839DA813D03}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA9A7BFF-908F-4E76-A25D-C839DA813D03}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8D303B~1.DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DCB52E86-3605-424A-8FDA-C28CD550B55A}\1.0\FLAGS\ = "2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DCB52E86-3605-424A-8FDA-C28CD550B55A}\1.0\HELPDIR\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B6E5CF2-6420-41EA-8DFE-0736CBD6D51F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9C04FC3-13FD-4FF5-9957-42DE9E82B43F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9C04FC3-13FD-4FF5-9957-42DE9E82B43F}\TypeLib\ = "{DCB52E86-3605-424A-8FDA-C28CD550B55A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EVIDENCE.EvidenceCtrl.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA9A7BFF-908F-4E76-A25D-C839DA813D03}\Control regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EVIDENCE.EvidenceCtrl.1\ = "Evidence Control" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9C04FC3-13FD-4FF5-9957-42DE9E82B43F}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9C04FC3-13FD-4FF5-9957-42DE9E82B43F}\ = "_DEvidenceEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D43AC0E-BC61-441D-9371-51BE5BB92F89}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8D303B~1.DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA9A7BFF-908F-4E76-A25D-C839DA813D03}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DCB52E86-3605-424A-8FDA-C28CD550B55A}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B6E5CF2-6420-41EA-8DFE-0736CBD6D51F}\TypeLib\ = "{DCB52E86-3605-424A-8FDA-C28CD550B55A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA9A7BFF-908F-4E76-A25D-C839DA813D03}\ToolboxBitmap32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9C04FC3-13FD-4FF5-9957-42DE9E82B43F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9C04FC3-13FD-4FF5-9957-42DE9E82B43F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA9A7BFF-908F-4E76-A25D-C839DA813D03} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EVIDENCE.EvidenceCtrl.1\CLSID\ = "{CA9A7BFF-908F-4E76-A25D-C839DA813D03}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B6E5CF2-6420-41EA-8DFE-0736CBD6D51F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9C04FC3-13FD-4FF5-9957-42DE9E82B43F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DCB52E86-3605-424A-8FDA-C28CD550B55A}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8d303beba3c0c06293966bb7e5e79a6295b494ec9f979744b9335b5cd471a5bb.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B6E5CF2-6420-41EA-8DFE-0736CBD6D51F}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9C04FC3-13FD-4FF5-9957-42DE9E82B43F}\TypeLib\ = "{DCB52E86-3605-424A-8FDA-C28CD550B55A}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA9A7BFF-908F-4E76-A25D-C839DA813D03}\ = "Evidence Control" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA9A7BFF-908F-4E76-A25D-C839DA813D03}\ProgID\ = "EVIDENCE.EvidenceCtrl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA9A7BFF-908F-4E76-A25D-C839DA813D03}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA9A7BFF-908F-4E76-A25D-C839DA813D03}\MiscStatus\1\ = "131473" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DCB52E86-3605-424A-8FDA-C28CD550B55A}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B6E5CF2-6420-41EA-8DFE-0736CBD6D51F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9C04FC3-13FD-4FF5-9957-42DE9E82B43F}\ = "_DEvidenceEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B6E5CF2-6420-41EA-8DFE-0736CBD6D51F}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9C04FC3-13FD-4FF5-9957-42DE9E82B43F}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B6E5CF2-6420-41EA-8DFE-0736CBD6D51F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B6E5CF2-6420-41EA-8DFE-0736CBD6D51F}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA9A7BFF-908F-4E76-A25D-C839DA813D03}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA9A7BFF-908F-4E76-A25D-C839DA813D03}\TypeLib\ = "{DCB52E86-3605-424A-8FDA-C28CD550B55A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DCB52E86-3605-424A-8FDA-C28CD550B55A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DCB52E86-3605-424A-8FDA-C28CD550B55A}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9C04FC3-13FD-4FF5-9957-42DE9E82B43F}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D43AC0E-BC61-441D-9371-51BE5BB92F89}\InprocServer32 regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1632 wrote to memory of 3932 1632 regsvr32.exe 89
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8d303beba3c0c06293966bb7e5e79a6295b494ec9f979744b9335b5cd471a5bb.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\8d303beba3c0c06293966bb7e5e79a6295b494ec9f979744b9335b5cd471a5bb.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3932
-