ba83b8bb4234d477f5bcb33a26ce1fca131b721ae2fc61834cc2c63ebf8fc412

Analysis

max time kernel
1s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-03-2023 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Filmora9/NLEBackBench.dll
Size

29KB
MD5

74f44714e086050e45a7f0d9db30f572
SHA1

bc4f1a7ffd6d9c6554d7019ea991f8674f36e70d
SHA256

dde6d8ab37e708f927522858b2a4695f58590c38615d03daadf4969b2e6731a2
SHA512

16a2e942a504feff605bc54d9dcc3e674d3052470481a2cae34a88ffd7a257775ba2348df6ec9abfcbc3dc845af1b5adc32ab0831a934e3142b29f776ec3e40a
SSDEEP

384:zMDyVsGuHzKbKXvjN1hNXKrmUu9PoUJPMl90svqfLaCmB3ZQZq8ydencZ6eOAD+z:VsvjNX9PU0svqfL5qp4ydycFOAD+iWR

Score

7^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{18792432-1B35-F0C6-A2D3-FF11897BC559}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{18792432-1B35-F0C6-A2D3-FF11897BC559}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filmora9\\NLEBackBench.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{18792432-1B35-F0C6-A2D3-FF11897BC559}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe

Modifies registry class 5 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{18792432-1B35-F0C6-A2D3-FF11897BC559}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{18792432-1B35-F0C6-A2D3-FF11897BC559}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filmora9\\NLEBackBench.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{18792432-1B35-F0C6-A2D3-FF11897BC559}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{18792432-1B35-F0C6-A2D3-FF11897BC559}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{18792432-1B35-F0C6-A2D3-FF11897BC559}\ = "NLECommon Component"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Filmora9\NLEBackBench.dll
1⤵
- Registers COM server for autorun
- Modifies registry class
PID:1668

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads