23a365f7ae216bf34be336f348f1c0bbbdf19e38d72669568136dcd0b72a47aa

Analysis

max time kernel
0s
max time network
3s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bin/dinput8.dll
Size

128KB
MD5

c9b973183908a6631b31ca29f863b4d1
SHA1

6b32c09f1404be8f9eb21e6c1b8955f4bf00e51d
SHA256

9fd9e02353b7d39fe07b9667f7ea2697229a7f2d0e7d389eb79eb212b1bb181d
SHA512

aa63cfba16d5c134b7478fc27b32e4b1e588f5910205e050d94b59a15f95d886ecaa4c2d494c7c3496b2bb8f386e7a540ec999190714b6e048c6bc07d1a43755
SSDEEP

3072:OBK5kXMCQ9hTn7TYgESRbApwUEfo9c+SJwVvjPIB:8K5kXMl5TYgXR02UWPrJAjPI

Score

7^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25E609E4-B259-11CF-BFC7-444553540000}\InProcServer32	regsvr32.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25E609E4-B259-11CF-BFC7-444553540000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25E609E4-B259-11CF-BFC7-444553540000}\InProcServer32	regsvr32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1228	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bin\dinput8.dll
1⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads