22e506a81c6fb6335840f46f41d7e556914b13a6b61c0e47b693c0c097af0e15

Analysis

max time kernel
132s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 06:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0c63fdf91caf02db210d049ec7030838.dll
Size

92KB
MD5

0c63fdf91caf02db210d049ec7030838
SHA1

ccf2010710a201187c8473fdc0efbef7f04383bb
SHA256

22e506a81c6fb6335840f46f41d7e556914b13a6b61c0e47b693c0c097af0e15
SHA512

094b72dd6097ba016891fc501b4a5345c8e262c7614e248c386e39baddc858c801c3f0d3505c6630cb4104317e5c12ec7023afc3951d7f25a5706a24674cce65
SSDEEP

1536:mZualbvORGjkJH/isKVmMyWVq5YzlhYqWOYuwJ5k6gSF0q8:CmRAMH/GaYzlh1WOgJngSF0

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ShareClipboardExtension = "{63c6b50f-0b47-466e-839a-1b110313e0ff}"	regsvr32.exe

Loads dropped DLL 2 IoCs

pid	Process
812	regsvr32.exe
812	regsvr32.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\ShareClipboardExtension\ShareClipboardExtension.dll	regsvr32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{63c6b50f-0b47-466e-839a-1b110313e0ff}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{63c6b50f-0b47-466e-839a-1b110313e0ff}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{63c6b50f-0b47-466e-839a-1b110313e0ff}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{63c6b50f-0b47-466e-839a-1b110313e0ff}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\ShareClipboardExtension\\ShareClipboardExtension.dll"	regsvr32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
812	regsvr32.exe
812	regsvr32.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
812	regsvr32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
812	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 812	2148	regsvr32.exe	88
PID 2148 wrote to memory of 812	2148	regsvr32.exe	88
PID 2148 wrote to memory of 812	2148	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0c63fdf91caf02db210d049ec7030838.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0c63fdf91caf02db210d049ec7030838.dll
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\ShareClipboardExtension\ShareClipboardExtension.dll

Filesize
92KB

MD5
0c63fdf91caf02db210d049ec7030838

SHA1
ccf2010710a201187c8473fdc0efbef7f04383bb

SHA256
22e506a81c6fb6335840f46f41d7e556914b13a6b61c0e47b693c0c097af0e15

SHA512
094b72dd6097ba016891fc501b4a5345c8e262c7614e248c386e39baddc858c801c3f0d3505c6630cb4104317e5c12ec7023afc3951d7f25a5706a24674cce65

Download Submit
memory/812-5-0x0000000000520000-0x0000000000537000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads