Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 23:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f729d2cd46f86fe131e9bf9a5373dadfb15de55f6247679f38ef2ef23320aedc.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f729d2cd46f86fe131e9bf9a5373dadfb15de55f6247679f38ef2ef23320aedc.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target f729d2cd46f86fe131e9bf9a5373dadfb15de55f6247679f38ef2ef23320aedc.dll
- Size 272KB
- Sample261107-3fsysswtaw
- SHA256 f729d2cd46f86fe131e9bf9a5373dadfb15de55f6247679f38ef2ef23320aedc
- MD5 2b2a32146845680312eba5d9293a3b31
- SHA1 2cd06da5e59ee80d8acb1c35b4a2f92d214d40e3
- SHA512 71542b56e2afcbefc1f88b32d63bb0539017484f3cb8c3ce67aac0afd5ccd32410abd7d056c06520fea4e525707e746088ba106d6c7936f651e5faf51a27de0d
- SSDEEP 6144:65xy215E9xQuyTisQNC0EsRPMh0uZMEoR1UCOjHRg:65xyrsKtEhFJ2WHR
- TLSH T187448C0B73ABCA70C3DC0D3498941B240B795D40EEA3ADB72B683A6E1DB6D155C8673D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D48166F2-B794-4125-A05B-5ECD46453A8C}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D62C3B2A-B719-4B2E-BC6F-4560B18E6163}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C4C29BA-632F-40FC-9F30-2E176CA6FDA0}\ = "IXmlEncoding" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BB316305-3640-4403-87A6-E800EEDD95E2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{87BECD0C-EA64-43B1-AC0F-A4CDEBD749A6}\ProgID\ = "LtXmlComHelp21.WhitespaceUtils.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.REParser.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.FastString.1\ = "FastString Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{87BECD0C-EA64-43B1-AC0F-A4CDEBD749A6}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{87BECD0C-EA64-43B1-AC0F-A4CDEBD749A6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.BigInteger.1\ = "BigInteger Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{887E8D56-E0B0-4AAE-83B6-4BDF5B9E6044}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{887E8D56-E0B0-4AAE-83B6-4BDF5B9E6044}\TypeLib\ = "{39F7E5D2-B9DD-4603-BC1E-033C2D85AA61}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DBF1AA6-9134-4E13-8FEE-8196EC206DE8}\VersionIndependentProgID\ = "LtXmlComHelp21.REParser" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.BinaryFile.1\ = "BinaryFile Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{39F7E5D2-B9DD-4603-BC1E-033C2D85AA61}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{887E8D56-E0B0-4AAE-83B6-4BDF5B9E6044}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F263402-E8CE-4887-A014-4CCF04DDF264}\TypeLib\ = "{39F7E5D2-B9DD-4603-BC1E-033C2D85AA61}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C4C29BA-632F-40FC-9F30-2E176CA6FDA0}\TypeLib\ = "{39F7E5D2-B9DD-4603-BC1E-033C2D85AA61}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DBF1AA6-9134-4E13-8FEE-8196EC206DE8}\TypeLib\ = "{39F7E5D2-B9DD-4603-BC1E-033C2D85AA61}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.FastString\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.BigInteger regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.XmlEncoding.1\CLSID\ = "{E5E081D1-93D1-4BAE-BB47-9581CAF523F0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D48166F2-B794-4125-A05B-5ECD46453A8C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CAB979D8-E66D-410F-A273-99A7E890B5B9}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2793CC71-1EDB-410C-9502-7FBDD028178D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DBF1AA6-9134-4E13-8FEE-8196EC206DE8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f729d2cd46f86fe131e9bf9a5373dadfb15de55f6247679f38ef2ef23320aedc.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.FastString regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A9AC2B2-5577-41E2-85A8-FE05ACEFE0C9}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A9AC2B2-5577-41E2-85A8-FE05ACEFE0C9}\TypeLib\ = "{39F7E5D2-B9DD-4603-BC1E-033C2D85AA61}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E14B67A9-0194-4D37-A704-2A58E7E3FC97}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8B03E5D4-DAEA-4423-A506-16A88518D6EC}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C4C29BA-632F-40FC-9F30-2E176CA6FDA0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DBF1AA6-9134-4E13-8FEE-8196EC206DE8}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.BigInteger\CLSID\ = "{5A9AC2B2-5577-41E2-85A8-FE05ACEFE0C9}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{39F7E5D2-B9DD-4603-BC1E-033C2D85AA61} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CAB979D8-E66D-410F-A273-99A7E890B5B9}\ = "IREParser" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C4C29BA-632F-40FC-9F30-2E176CA6FDA0}\ = "IXmlEncoding" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.UnicodeFile.1\ = "UnicodeFile Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5E081D1-93D1-4BAE-BB47-9581CAF523F0}\ = "XmlEncoding Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.REParser.1\ = "REParser Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.FastString\CLSID\ = "{3F96DDB0-C2AF-40FF-A8D8-D59A7A8538B5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F96DDB0-C2AF-40FF-A8D8-D59A7A8538B5}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f729d2cd46f86fe131e9bf9a5373dadfb15de55f6247679f38ef2ef23320aedc.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.BinaryFile\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F263402-E8CE-4887-A014-4CCF04DDF264}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.FastString.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.FastString.1\CLSID\ = "{3F96DDB0-C2AF-40FF-A8D8-D59A7A8538B5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D48166F2-B794-4125-A05B-5ECD46453A8C}\ = "BinaryFile Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.WhitespaceUtils.1\CLSID\ = "{87BECD0C-EA64-43B1-AC0F-A4CDEBD749A6}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{887E8D56-E0B0-4AAE-83B6-4BDF5B9E6044} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{887E8D56-E0B0-4AAE-83B6-4BDF5B9E6044}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.FastString\ = "FastString Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.FastString\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.UnicodeFile.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{80F23118-D5CA-42D4-B534-3C91814CB044}\ProgID\ = "LtXmlComHelp21.UnicodeFile.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.WhitespaceUtils regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.BigInteger.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{39F7E5D2-B9DD-4603-BC1E-033C2D85AA61}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB316305-3640-4403-87A6-E800EEDD95E2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DBF1AA6-9134-4E13-8FEE-8196EC206DE8}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LtXmlComHelp21.XmlEncoding.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5E081D1-93D1-4BAE-BB47-9581CAF523F0}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{80F23118-D5CA-42D4-B534-3C91814CB044}\ = "UnicodeFile Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{39F7E5D2-B9DD-4603-BC1E-033C2D85AA61}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D48166F2-B794-4125-A05B-5ECD46453A8C}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1192 wrote to memory of 3296 1192 regsvr32.exe 87
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f729d2cd46f86fe131e9bf9a5373dadfb15de55f6247679f38ef2ef23320aedc.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\f729d2cd46f86fe131e9bf9a5373dadfb15de55f6247679f38ef2ef23320aedc.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3296
-