ba83b8bb4234d477f5bcb33a26ce1fca131b721ae2fc61834cc2c63ebf8fc412

Analysis

max time kernel
60s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2023 22:25

Target

Filmora9/NLEBackBench.dll
Size

29KB
MD5

74f44714e086050e45a7f0d9db30f572
SHA1

bc4f1a7ffd6d9c6554d7019ea991f8674f36e70d
SHA256

dde6d8ab37e708f927522858b2a4695f58590c38615d03daadf4969b2e6731a2
SHA512

16a2e942a504feff605bc54d9dcc3e674d3052470481a2cae34a88ffd7a257775ba2348df6ec9abfcbc3dc845af1b5adc32ab0831a934e3142b29f776ec3e40a
SSDEEP

384:zMDyVsGuHzKbKXvjN1hNXKrmUu9PoUJPMl90svqfLaCmB3ZQZq8ydencZ6eOAD+z:VsvjNX9PU0svqfL5qp4ydycFOAD+iWR

Score

7^/10

persistence

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{18792432-1B35-F0C6-A2D3-FF11897BC559}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{18792432-1B35-F0C6-A2D3-FF11897BC559}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{18792432-1B35-F0C6-A2D3-FF11897BC559}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filmora9\\NLEBackBench.dll"	regsvr32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{18792432-1B35-F0C6-A2D3-FF11897BC559}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{18792432-1B35-F0C6-A2D3-FF11897BC559}\ = "NLECommon Component"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{18792432-1B35-F0C6-A2D3-FF11897BC559}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{18792432-1B35-F0C6-A2D3-FF11897BC559}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filmora9\\NLEBackBench.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{18792432-1B35-F0C6-A2D3-FF11897BC559}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact