ddb62fe8611e6e37b8b37413dea5e5f813f441e1601f8c805787a2d94265a8cb

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

office2019pjb_9435/office2019pjb/OTool/files/Thunder/dl_peer_id.dll
Size

89KB
MD5

dba9a19752b52943a0850a7e19ac600a
SHA1

3485ac30cd7340eccb0457bca37cf4a6dfda583d
SHA256

69a5e2a51094dc8f30788d63243b12a0eb2759a3f3c3a159b85fd422fc00ac26
SHA512

a42c1ec5594c6f6cae10524cdad1f9da2bdc407f46e685e56107de781b9bce8210a8cd1a53edacd61365d37a1c7ceba3b0891343cf2c31d258681e3bf85049d3
SSDEEP

1536:5myH1Ar4zLdIoXJED0ySFzyhSU+kcexDCaDRqxAnNQDB:foEZEDDSFzDkce7RqxAnIB

Score

1^/10

Malware Config

Signatures

Modifies registry class 44 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId.1\CLSID\ = "{5D72951E-2B86-41B9-835F-464346928269}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\ProgID\ = "Dl_peer_id.XlPeerId.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\office2019pjb_9435\\office2019pjb\\OTool\\files\\Thunder\\dl_peer_id.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\TypeLib\ = "{3E618540-AFE5-4DFC-B440-1A760323133B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin.1\ = "DownloadLibPlugin Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin\ = "DownloadLibPlugin Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin\CurVer\ = "Dl_peer_id.DownloadLibPlugin.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin.1\CLSID\ = "{D76D152E-836B-489B-A333-930A7F22A1D4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId.1\ = "XlPeerId Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\ = "XlPeerId Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\ = "DownloadLibPlugin Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\ProgID\ = "Dl_peer_id.DownloadLibPlugin.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\TypeLib\ = "{3E618540-AFE5-4DFC-B440-1A760323133B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId\ = "XlPeerId Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\VersionIndependentProgID\ = "Dl_peer_id.XlPeerId"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId\CurVer\ = "Dl_peer_id.XlPeerId.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin\CLSID\ = "{D76D152E-836B-489B-A333-930A7F22A1D4}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId\CLSID\ = "{5D72951E-2B86-41B9-835F-464346928269}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.XlPeerId.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D72951E-2B86-41B9-835F-464346928269}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\office2019pjb_9435\\office2019pjb\\OTool\\files\\Thunder\\dl_peer_id.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dl_peer_id.DownloadLibPlugin\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D76D152E-836B-489B-A333-930A7F22A1D4}\VersionIndependentProgID\ = "Dl_peer_id.DownloadLibPlugin"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 2772	4656	regsvr32.exe	91
PID 4656 wrote to memory of 2772	4656	regsvr32.exe	91
PID 4656 wrote to memory of 2772	4656	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\Thunder\dl_peer_id.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\Thunder\dl_peer_id.dll
  2⤵
  - Modifies registry class
  PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3736 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:3312

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads