Overview
overview
10Static
static
1Agenzia_En...da.exe
windows7-x64
10Agenzia_En...da.exe
windows10-2004-x64
10Agenzia_En...ov.dll
windows7-x64
1Agenzia_En...ov.dll
windows10-2004-x64
1Agenzia_En...er.dll
windows7-x64
1Agenzia_En...er.dll
windows10-2004-x64
1Agenzia_En...bs.dll
windows7-x64
1Agenzia_En...bs.dll
windows10-2004-x64
3Agenzia_En...om.dll
windows7-x64
1Agenzia_En...om.dll
windows10-2004-x64
1Agenzia_En...in.dll
windows7-x64
1Agenzia_En...in.dll
windows10-2004-x64
7Agenzia_En...32.dll
windows7-x64
1Agenzia_En...32.dll
windows10-2004-x64
7Agenzia_En...xe.dll
windows7-x64
1Agenzia_En...xe.dll
windows10-2004-x64
1Agenzia_En...16.dll
windows7-x64
1Agenzia_En...16.dll
windows10-2004-x64
1Agenzia_En...bs.dll
windows7-x64
1Agenzia_En...bs.dll
windows10-2004-x64
1Agenzia_En...om.dll
windows7-x64
1Agenzia_En...om.dll
windows10-2004-x64
1Analysis
-
max time kernel
138s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
02-03-2023 12:42
Static task
static1
Behavioral task
behavioral1
Sample
Agenzia_Entrate/Informazione_Azienda.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral2
Sample
Agenzia_Entrate/Informazione_Azienda.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Agenzia_Entrate/report/drivers/DMWmiBridgeProv.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral4
Sample
Agenzia_Entrate/report/drivers/DMWmiBridgeProv.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Agenzia_Entrate/report/drivers/XblAuthManager.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral6
Sample
Agenzia_Entrate/report/drivers/XblAuthManager.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Agenzia_Entrate/report/drivers/mfcsubs.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral8
Sample
Agenzia_Entrate/report/drivers/mfcsubs.dll
Resource
win10v2004-20230221-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Agenzia_Entrate/report/drivers/wxmsw30u_core_gcc_custom.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral10
Sample
Agenzia_Entrate/report/drivers/wxmsw30u_core_gcc_custom.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Agenzia_Entrate/report/tran/app/drivers/AppManMigrationPlugin.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral12
Sample
Agenzia_Entrate/report/tran/app/drivers/AppManMigrationPlugin.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Agenzia_Entrate/report/tran/app/drivers/cimwin32.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral14
Sample
Agenzia_Entrate/report/tran/app/drivers/cimwin32.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Agenzia_Entrate/report/tran/app/en/audit.exe.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral16
Sample
Agenzia_Entrate/report/tran/app/en/audit.exe.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Agenzia_Entrate/report/tran/app/en/libpng16-16.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral18
Sample
Agenzia_Entrate/report/tran/app/en/libpng16-16.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Agenzia_Entrate/report/tran/app/short/Xaml.Controls.Tabs.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral20
Sample
Agenzia_Entrate/report/tran/app/short/Xaml.Controls.Tabs.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Agenzia_Entrate/report/tran/app/short/wxmsw30u_core_gcc_custom.dll
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral22
Sample
Agenzia_Entrate/report/tran/app/short/wxmsw30u_core_gcc_custom.dll
Resource
win10v2004-20230221-en
windows10-2004-x64
General
-
Target
Agenzia_Entrate/report/tran/app/drivers/AppManMigrationPlugin.dll
-
Size
1.2MB
-
MD5
3e4ead79d46b37df5ea8304d0ac81203
-
SHA1
9a4a8025a436e2195d8e4a2e6a3b8fd38803df60
-
SHA256
a3fcb57f0246a47954d295a93238b9030ecbc8b4629171d1970d3a1a7e116c6c
-
SHA512
d364b6f14d18e02ae5f4121eba5a23f5125b8bda1796a952b299e0b714975e5e3c9382ecde53fe5c3071659b4dde5836b9eb8cef725e5c26b1b83c45792281db
-
SSDEEP
24576:lBQ7WkYroJl3Gr4BHinn5tc6WncxnPzey+IzpkMWfnTtpkODim+:l5km2RG8BHi58kODi1
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Agenzia_Entrate\\report\\tran\\app\\drivers\\AppManMigrationPlugin.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}\InprocServer32\ThreadingModel = "free" regsvr32.exe -
Modifies registry class 27 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}\ProgID\ = "AppManMig.CMigrationPlugin.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}\AppID = "{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppManMig.CMigrationPlugin.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppManMig.CMigrationPlugin\ = "CMigrationPlugin Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}\InprocServer32\ThreadingModel = "free" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppManMig.CMigrationPlugin.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}\VersionIndependentProgID\ = "AppManMig.CMigrationPlugin" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}\ = "AppManMigration" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\AppManMigration.DLL\AppID = "{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppManMig.CMigrationPlugin\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppManMig.CMigrationPlugin\CurVer\ = "AppManMig.CMigrationPlugin.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppManMig.CMigrationPlugin\CLSID\ = "{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}\TypeLib\ = "{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Agenzia_Entrate\\report\\tran\\app\\drivers\\AppManMigrationPlugin.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppManMig.CMigrationPlugin.1\CLSID\ = "{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppManMig.CMigrationPlugin regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}\ = "CMigrationPlugin Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppManMig.CMigrationPlugin.1\ = "CMigrationPlugin Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppManMig.CMigrationPlugin\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{2AF7D9A3-FA1C-410A-B6D3-C6AD32232531} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\AppManMigration.DLL regsvr32.exe