43970e64f251040e9284a4cec968b01cce4a3cd23be67a1f21dd14e54f7a9bf1 | Triage

Analysis

max time kernel
91s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-04-2022 22:06

Sharing

Report Analysis Logs

General

Target

Adobe-Photoshop-CC-2022-1.4-main/packages/packages/Program Files (x86)/ASIO4ALL v2/asio4all.dll
Size

115KB
MD5

de9b771e11a5800254354124e16856ee
SHA1

d86ec1217077f65bdae1bc207ba16ad5ed98feaf
SHA256

f53f755e8ae24f9e6d1b925bf32702cf4bd0a92511f87d6c3503830a1fbef9da
SHA512

ea0c022843997c05d9d542479dc8c32e6df9bb0e936b1d3e12aeba3ee46b45cee059e640bc0fa777535befc1cfb9d08cddfc32c6090999c19a4171cf479ababd

Score

1^/10

Malware Config

Signatures

Modifies registry class 5 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\ = "ASIO4ALL v2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{232685C6-6548-49D8-846D-4141A3EF7560}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe-Photoshop-CC-2022-1.4-main\\packages\\packages\\Program Files (x86)\\ASIO4ALL v2\\asio4all.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1240 wrote to memory of 1704	1240	regsvr32.exe	regsvr32.exe
PID 1240 wrote to memory of 1704	1240	regsvr32.exe	regsvr32.exe
PID 1240 wrote to memory of 1704	1240	regsvr32.exe	regsvr32.exe
PID 1240 wrote to memory of 1704	1240	regsvr32.exe	regsvr32.exe
PID 1240 wrote to memory of 1704	1240	regsvr32.exe	regsvr32.exe
PID 1240 wrote to memory of 1704	1240	regsvr32.exe	regsvr32.exe
PID 1240 wrote to memory of 1704	1240	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Adobe-Photoshop-CC-2022-1.4-main\packages\packages\Program Files (x86)\ASIO4ALL v2\asio4all.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\Adobe-Photoshop-CC-2022-1.4-main\packages\packages\Program Files (x86)\ASIO4ALL v2\asio4all.dll"
2⤵
- Modifies registry class
PID:1704

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1240-54-0x000007FEFB751000-0x000007FEFB753000-memory.dmp

Filesize
8KB

Download
memory/1704-55-0x0000000000000000-mapping.dmp

Download
memory/1704-56-0x0000000075541000-0x0000000075543000-memory.dmp

Filesize
8KB

Download