9977291ab2a17549ea194ee338da6dab687d3ad945b7f249b5595d770c675194

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fastcopy 5.4.3/FastCopy64/FastEx11.dll
Size

311KB
MD5

4e8541368912fbf84fd49519a66a8bab
SHA1

082e23c0a2420cfe0a9ee9b31daa9c6c4be34740
SHA256

0c0059a64ddb51209bd798644072cfc34b8b89ed37cd4fdeb051f7bb35818519
SHA512

392470cc72bd782b442555569a304c16a442d332ee2f3706957738eef0256a174afa0bae9aeecf129a42e3773c7a249cfeb384a9811b8a5ab792c95132c5b15a
SSDEEP

6144:OIn7m7fGtlqM3NIkV+vmq1pUNlF6CjyoTH6rcA0TnjuqOG:eGtlqz6q1pUNl/y66oRCxG

Score

4^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 3 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\FastCopy	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\FastCopy\ = "{72FF462B-AB7D-427A-A268-E22E414933D7}"	regsvr32.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{72FF462B-AB7D-427A-A268-E22E414933D7}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{72FF462B-AB7D-427A-A268-E22E414933D7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Fastcopy 5.4.3\\FastCopy64\\FastEx11.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{72FF462B-AB7D-427A-A268-E22E414933D7}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\ShellEx\ContextMenuHandlers\FastCopy\ = "{72FF462B-AB7D-427A-A268-E22E414933D7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\FastCopy	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\FastCopy	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\DragDropHandlers\FastCopy	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shellex\ContextMenuHandlers\FastCopy	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\FastCopy\ = "{72FF462B-AB7D-427A-A268-E22E414933D7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\FastCopy	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\FastCopy\ = "{72FF462B-AB7D-427A-A268-E22E414933D7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{72FF462B-AB7D-427A-A268-E22E414933D7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{72FF462B-AB7D-427A-A268-E22E414933D7}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\FastCopy\ = "{72FF462B-AB7D-427A-A268-E22E414933D7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\DragDropHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\FastCopy	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{72FF462B-AB7D-427A-A268-E22E414933D7}\ = "FastCopy"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{72FF462B-AB7D-427A-A268-E22E414933D7}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\DragDropHandlers\FastCopy\ = "{72FF462B-AB7D-427A-A268-E22E414933D7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\FastCopy	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\FastCopy	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\FastCopy\ = "{72FF462B-AB7D-427A-A268-E22E414933D7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\FastCopy\ = "{72FF462B-AB7D-427A-A268-E22E414933D7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\ShellEx\ContextMenuHandlers\FastCopy	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shellex\ContextMenuHandlers\FastCopy\ = "{72FF462B-AB7D-427A-A268-E22E414933D7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\FastCopy\ = "{72FF462B-AB7D-427A-A268-E22E414933D7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shellex\ContextMenuHandlers	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\FastCopy\ = "{72FF462B-AB7D-427A-A268-E22E414933D7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{72FF462B-AB7D-427A-A268-E22E414933D7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Fastcopy 5.4.3\\FastCopy64\\FastEx11.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\FastCopy	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\FastCopy\ = "{72FF462B-AB7D-427A-A268-E22E414933D7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\FastCopy	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Fastcopy 5.4.3\FastCopy64\FastEx11.dll"
1⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Modifies registry class
PID:1924