a0827544defe24a521a9ffea5dc895cf30b892a1f54a4cbcadd0005dfcbba89d

Analysis

max time kernel
7s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
04/04/2024, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PrintConfig.dll
Size 3.9MB
Sample240404-pp5r3afd2x
SHA256 a0827544defe24a521a9ffea5dc895cf30b892a1f54a4cbcadd0005dfcbba89d
MD5 f9bc9754f012ca14a05eb89eef3f9f26
SHA1 2fe04bfaceb114e5dc2ef3625851114f017fb3f3
SHA512 7e481f297e2350bd46a9e41b357aa63870c3e3394681bdf098872a838b6a0da6d589f6ae3d74523d41c98e772d690a3ff5710ac364734d4520a7927c8e9f72e2
SSDEEP 49152:87zplXMMs0arkp5J22DNBHkNiYWiMzd7a869kPkH+hiATVm1gDCAb4MbaK+EwezN:OplXM4puWih90VGhXw+38D
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PrintNotify\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PrintConfig.dll"	regsvr32.exe

Registers COM server for autorun 1 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PrintConfig.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{95A24F08-5D9A-46F4-8B35-F9905397C741}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{95A24F08-5D9A-46F4-8B35-F9905397C741}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PrintConfig.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{95A24F08-5D9A-46F4-8B35-F9905397C741}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe

Modifies registry class 63 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{839BCD19-FADC-4673-9D5A-FE970B507FA3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{839BCD19-FADC-4673-9D5A-FE970B507FA3}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBC361D2-B7A6-4FEB-A237-35CC98300A4A}\ = "IPrintSchemaOptionInternal"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{95A24F08-5D9A-46F4-8B35-F9905397C741}\ = "PSFactoryBuffer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95A24F08-5D9A-46F4-8B35-F9905397C741}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PrintConfig.PrinterExtensionManager\CLSID\ = "{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{95A24F08-5D9A-46F4-8B35-F9905397C741}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF409217-79B9-4FB3-9F9C-9C13DBCEE658}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF409217-79B9-4FB3-9F9C-9C13DBCEE658}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF409217-79B9-4FB3-9F9C-9C13DBCEE658}\ProxyStubClsid32\ = "{95A24F08-5D9A-46F4-8B35-F9905397C741}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95A24F08-5D9A-46F4-8B35-F9905397C741}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBC361D2-B7A6-4FEB-A237-35CC98300A4A}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PrintConfig.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{854A20FB-2D44-457D-992F-EF13785D2B51}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF409217-79B9-4FB3-9F9C-9C13DBCEE658}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBC361D2-B7A6-4FEB-A237-35CC98300A4A}\ProxyStubClsid32\ = "{95A24F08-5D9A-46F4-8B35-F9905397C741}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C3854CE3-9FDD-4249-8247-EC0574314CCC}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{588E10FA-0618-48A1-BE2F-0AD93E899FCC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{854A20FB-2D44-457D-992F-EF13785D2B51}\AppID = "{588E10FA-0618-48A1-BE2F-0AD93E899FCC}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBC361D2-B7A6-4FEB-A237-35CC98300A4A}\NumMethods\ = "4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C3854CE3-9FDD-4249-8247-EC0574314CCC}\ = "IPrinterExtensionServerEventCallbackInternal"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{588E10FA-0618-48A1-BE2F-0AD93E899FCC}\LaunchPermission = 010004805c0000006c00000000000000140000000200480003000000000014000b000000010100000000000512000000000018000b00000001020000000000052000000020020000000014000b0000000101000000000005040000000102000000000005200000002002000001020000000000052000000020020000	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Interface	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95A24F08-5D9A-46F4-8B35-F9905397C741}\ProxyStubClsid32\ = "{95A24F08-5D9A-46F4-8B35-F9905397C741}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95A24F08-5D9A-46F4-8B35-F9905397C741}\ = "IPrinterExtensionServerEventInternal"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{588E10FA-0618-48A1-BE2F-0AD93E899FCC}\LocalService = "PrintNotify"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91CE54EE-C67C-4B46-A4FF-99416F27A8BF}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PrintConfig.dll\\1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{95A24F08-5D9A-46F4-8B35-F9905397C741}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C3854CE3-9FDD-4249-8247-EC0574314CCC}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{588E10FA-0618-48A1-BE2F-0AD93E899FCC}\AccessPermission = 010004805c0000006c00000000000000140000000200480003000000000014000300000001010000000000050a00000000001400030000000101000000000005120000000000180003000000010200000000000520000000200200000102000000000005200000002002000001020000000000052000000020020000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}\ProgID\ = "PrintConfig.PrinterExtensionManager"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF409217-79B9-4FB3-9F9C-9C13DBCEE658}\NumMethods\ = "23"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95A24F08-5D9A-46F4-8B35-F9905397C741}\NumMethods\ = "4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CF409217-79B9-4FB3-9F9C-9C13DBCEE658}\ = "IPrintSchemaTicketInternal"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{839BCD19-FADC-4673-9D5A-FE970B507FA3}\NumMethods\ = "6"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBC361D2-B7A6-4FEB-A237-35CC98300A4A}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PrintConfig.PrinterExtensionManager\ = "Printer Extension Manager Class"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBC361D2-B7A6-4FEB-A237-35CC98300A4A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C3854CE3-9FDD-4249-8247-EC0574314CCC}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{95A24F08-5D9A-46F4-8B35-F9905397C741}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{839BCD19-FADC-4673-9D5A-FE970B507FA3}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C3854CE3-9FDD-4249-8247-EC0574314CCC}\NumMethods\ = "4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}\TypeLib\ = "{91CE54EE-C67C-4B46-A4FF-99416F27A8BF}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{854A20FB-2D44-457D-992F-EF13785D2B51}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C3854CE3-9FDD-4249-8247-EC0574314CCC}\ProxyStubClsid32\ = "{95A24F08-5D9A-46F4-8B35-F9905397C741}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{588E10FA-0618-48A1-BE2F-0AD93E899FCC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95A24F08-5D9A-46F4-8B35-F9905397C741}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{839BCD19-FADC-4673-9D5A-FE970B507FA3}\ProxyStubClsid32\ = "{95A24F08-5D9A-46F4-8B35-F9905397C741}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{839BCD19-FADC-4673-9D5A-FE970B507FA3}\ = "IPrinterExtensionServerInternal"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{588E10FA-0618-48A1-BE2F-0AD93E899FCC}\ = "PrintNotify"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331B60DA-9E90-4DD0-9C84-EAC4E659B61F}\ = "Printer Extension Manager Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{95A24F08-5D9A-46F4-8B35-F9905397C741}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PrintConfig.dll"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\PrintConfig.dll
1⤵
- Sets DLL path for service in the registry
- Registers COM server for autorun
- Modifies registry class
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads