a74fd03743f01e1336ceb1263eabf0b596b445ec77d526a9277c50b27f82e213

Analysis

max time kernel
0s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2743be6968b01b0584830f9b2297dd51.exe
Size

315KB
MD5

2743be6968b01b0584830f9b2297dd51
SHA1

d2b5f774e8dc217bba8c92cf254f9e95eb4a5cac
SHA256

a74fd03743f01e1336ceb1263eabf0b596b445ec77d526a9277c50b27f82e213
SHA512

c275177a73b818b3df46a2b848d3594ea84f7b87a76fd39bf8ac820335a54146b79295df547589b63ac04e578593ca2a002574624256a9a8c803f333dc45a27f
SSDEEP

6144:IdNHHXOl4UgMzuDNrVcb+6VzjEvix9WXh9s0lMv9szq4XOR:6nX2g/DNVcb4vix9T9s

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1772	2743be6968b01b0584830f9b2297dd51.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\COMCTL32.OCX	2743be6968b01b0584830f9b2297dd51.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4044 set thread context of 1772	4044	2743be6968b01b0584830f9b2297dd51.exe	15

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\InprocServer32\ThreadingModel = "Apartment"	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ACBB956-5C57-11CF-8993-00AA00688B10}\InprocServer32\ = "C:\\Windows\\SysWow64\\COMCTL32.OCX"	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA50-E020-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TabStrip\CurVer	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TabStrip.1\CLSID	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62823C20-41A3-11CE-9E8B-0020AF039CA3}\InprocServer32\ = "C:\\Windows\\SysWow64\\COMCTL32.OCX"	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider.1	2743be6968b01b0584830f9b2297dd51.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6027C2D4-FB28-11CD-8820-08002B2F4F5A}	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ListViewCtrl.1	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\ = "Microsoft ImageList Control, version 5.0 (SP2)"	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\ProgID	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E6393-850A-101B-AFC0-4210102A8DA7}\InprocServer32	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E63A3-850A-101B-AFC0-4210102A8DA7}\InprocServer32	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TabStrip\CLSID\ = "{9ED94440-E5E8-101B-B9B5-444553540000}"	2743be6968b01b0584830f9b2297dd51.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D96-9D6A-101B-AFC0-4210102A8DA7}	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\COMCTL32.OCX, 4"	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TreeCtrl\ = "Microsoft TreeView Control, version 5.0 (SP2)"	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\TypeLib	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\MiscStatus	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\MiscStatus	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider.1\CLSID	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62823C20-41A3-11CE-9E8B-0020AF039CA3}\InprocServer32	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E6393-850A-101B-AFC0-4210102A8DA7}\InprocServer32\ = "C:\\Windows\\SysWow64\\COMCTL32.OCX"	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\ProgID\ = "COMCTL.ListViewCtrl.1"	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\Control	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ProgCtrl.1\CLSID	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TabStrip.1\CLSID\ = "{9ED94440-E5E8-101B-B9B5-444553540000}"	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E63A3-850A-101B-AFC0-4210102A8DA7}\InprocServer32\ = "C:\\Windows\\SysWow64\\COMCTL32.OCX"	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D96-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Control	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\InprocServer32\ThreadingModel = "Apartment"	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\MiscStatus\1	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ImageListCtrl\CLSID\ = "{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}"	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Toolbar\CurVer	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.SBarCtrl.1\CLSID	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\MiscStatus\ = "0"	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\ = "Microsoft ListView Control, version 5.0 (SP2)"	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Version\ = "1.3"	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\MiscStatus\1\ = "131473"	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\ = "ITabStrip"	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\Version\ = "1.3"	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\ProgID\ = "COMCTL.SBarCtrl.1"	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.SBarCtrl\CurVer\ = "COMCTL.SBarCtrl.1"	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\VersionIndependentProgID	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\MiscStatus\1	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\Control	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\InprocServer32\ = "C:\\Windows\\SysWow64\\COMCTL32.OCX"	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\TypeLib\Version = "1.3"	2743be6968b01b0584830f9b2297dd51.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ACBB956-5C57-11CF-8993-00AA00688B10}	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\ProgID	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A8-850A-101B-AFC0-4210102A8DA7}\ = "TreeView General Property Page Object"	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A8-850A-101B-AFC0-4210102A8DA7}\InprocServer32\ = "C:\\Windows\\SysWow64\\COMCTL32.OCX"	2743be6968b01b0584830f9b2297dd51.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8628-0FB3-11CE-8747-524153480004}	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32\ = "C:\\Windows\\SysWow64\\COMCTL32.OCX"	2743be6968b01b0584830f9b2297dd51.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\TypeLib	2743be6968b01b0584830f9b2297dd51.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2743be6968b01b0584830f9b2297dd51.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4044	2743be6968b01b0584830f9b2297dd51.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1772	2743be6968b01b0584830f9b2297dd51.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 1772	4044	2743be6968b01b0584830f9b2297dd51.exe	15
PID 4044 wrote to memory of 1772	4044	2743be6968b01b0584830f9b2297dd51.exe	15
PID 4044 wrote to memory of 1772	4044	2743be6968b01b0584830f9b2297dd51.exe	15
PID 4044 wrote to memory of 1772	4044	2743be6968b01b0584830f9b2297dd51.exe	15
PID 4044 wrote to memory of 1772	4044	2743be6968b01b0584830f9b2297dd51.exe	15

C:\Users\Admin\AppData\Local\Temp\2743be6968b01b0584830f9b2297dd51.exe
"C:\Users\Admin\AppData\Local\Temp\2743be6968b01b0584830f9b2297dd51.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Users\Admin\AppData\Local\Temp\2743be6968b01b0584830f9b2297dd51.exe
  C:\Users\Admin\AppData\Local\Temp\2743be6968b01b0584830f9b2297dd51.exe
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1772-4-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1772-1-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1772-18-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4044-0-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/4044-2-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download