774e3967b822539cb0a145c0ae24a0869fc412c87a336b0e6f038255eed9dafc

Analysis

max time kernel
142s
max time network
512s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lghub/Configuration/System32/AuthFWGP.dll
Size

32KB
MD5

aec29dd818090c5fc3274179ef262d1a
SHA1

a237042bcf46f33b0616c11d592b2ef1387106e3
SHA256

24eddbf36e9a04a60dd092ea8c65cb30af18706fb2810e88de043c8cf163150a
SHA512

59e72f28d182b6eea46ad386708b8a1361476f8186460fa3c19bf7b18ec786fc4c400766acb575924c5694f9916768e2fa704ea0d6bd0a949912df07a08b1779
SSDEEP

384:BxBdwA7dUh6DtDVB41QwiqyRV+l0yZbwUzU6pcrWtnndjzJGkj0pEEQPA4rQsWyj:XBdwALtDmQt+6upTcAnpTj4vQoZ

Score

8^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0E752416-F29E-4195-A9DD-7F0D4D5A9D71}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{023A36FC-E9D5-419E-824A-CDC66A116E84}\InprocServer32	regsvr32.exe

Modifies registry class 5 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0E752416-F29E-4195-A9DD-7F0D4D5A9D71}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0E752416-F29E-4195-A9DD-7F0D4D5A9D71}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{023A36FC-E9D5-419E-824A-CDC66A116E84}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{023A36FC-E9D5-419E-824A-CDC66A116E84}\InprocServer32	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\lghub\Configuration\System32\AuthFWGP.dll
1⤵
- Registers COM server for autorun
- Modifies registry class
PID:1604

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads