b053b4d86d46e3fe1d1562ac41b9bf9573daa46421d03c1d3d7a95fa6766a9ab

Analysis

max time kernel
48s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b053b4d86d46e3fe1d1562ac41b9bf9573daa46421d03c1d3d7a95fa6766a9ab.dll
Size

835KB
MD5

fa23c87df8752921980210e4fe53a681
SHA1

3baa22188dd3dfed818a5691847767d1a12e6683
SHA256

b053b4d86d46e3fe1d1562ac41b9bf9573daa46421d03c1d3d7a95fa6766a9ab
SHA512

f1ec199614a6b8baa69df945e752ad5a1d6b84bdebf83f0e67a4c63f4fac946a6941f5825e295adae8a3adfeb3961f5746e7ec768984c63dc1cd508b7a03b65b
SSDEEP

24576:uNqwktBLPrt0fCmydcPZCkRQz3jeQEWgr:LwktBLPrwRydcBCklQE3

Score

8^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{599A2E47-16D2-468B-ABF6-4E6642EFC460}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{599A2E47-16D2-468B-ABF6-4E6642EFC460}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b053b4d86d46e3fe1d1562ac41b9bf9573daa46421d03c1d3d7a95fa6766a9ab.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{599A2E47-16D2-468B-ABF6-4E6642EFC460}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PCBApplicationInfo.DLL\AppID = "{76937EC0-15A1-48EA-BDD6-D4379298DA95}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{599A2E47-16D2-468B-ABF6-4E6642EFC460}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{599A2E47-16D2-468B-ABF6-4E6642EFC460}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b053b4d86d46e3fe1d1562ac41b9bf9573daa46421d03c1d3d7a95fa6766a9ab.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{599A2E47-16D2-468B-ABF6-4E6642EFC460}\AppID = "{76937EC0-15A1-48EA-BDD6-D4379298DA95}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{599A2E47-16D2-468B-ABF6-4E6642EFC460}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{76937EC0-15A1-48EA-BDD6-D4379298DA95}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{76937EC0-15A1-48EA-BDD6-D4379298DA95}\ = "PCBApplicationInfo"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PCBApplicationInfo.DLL	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{599A2E47-16D2-468B-ABF6-4E6642EFC460}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{599A2E47-16D2-468B-ABF6-4E6642EFC460}\ = "CPCBApplicationInfo Class"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b053b4d86d46e3fe1d1562ac41b9bf9573daa46421d03c1d3d7a95fa6766a9ab.dll
1⤵
- Registers COM server for autorun
- Modifies registry class
PID:1256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-54-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

Filesize
8KB

Download