60c4175e18abf22d705d855abb6f16e08b80b9fb829a08589b9e4ba750c47349

Analysis

max time kernel
125s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SimpleExt.dll
Size

149KB
MD5

59a05759b6be35e32573c73639e22747
SHA1

7a7da0302201d2f35977cf512e33d8c9c976c8c2
SHA256

f56246622a294120404f1d99a16cb9c734e8115929100289ddf14348c054385d
SHA512

1ccc6ab402a08cca5006f222670e0bd2a999ccd06236838f762eb17221a4dc6f6425375dce95f1580de6add03097c7838dcb0c656847d176c4767749ed2b8c22
SSDEEP

1536:dp/CH817QNmEu+ZsS9cpczhk76LOLJX3sVAG:T/fpa39Fw6SLJX3sVAG

Score

7^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\WOW6432Node\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\WOW6432Node\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SimpleExt.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\WOW6432Node\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\ScreenshoterRFShlExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shellex\ContextMenuHandlers\ScreenshoterRFShlExt\ = "{5E212111-0311-11D5-8D4B-444663541111}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\WOW6432Node\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Directory\Background\shellex\ContextMenuHandlers\ScreenshoterRFShlExt	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\WOW6432Node\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\ = "ScreenshoterRFShlExt Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E212111-0311-11D5-8D4B-444663541111}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SimpleExt.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\WOW6432Node\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Directory\Background\shellex\ContextMenuHandlers\ScreenshoterRFShlExt\ = "{5E212111-0311-11D5-8D4B-444663541111}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\ = "ScreenshoterRFShlExt Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\WOW6432Node\CLSID\{5E212111-0311-11D5-8D4B-444663541111}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\WOW6432Node\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SimpleExt.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 432	1856	regsvr32.exe	89
PID 1856 wrote to memory of 432	1856	regsvr32.exe	89
PID 1856 wrote to memory of 432	1856	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SimpleExt.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\SimpleExt.dll
  2⤵
  - Registers COM server for autorun
  - Modifies registry class
  PID:432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3452,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
1⤵
PID:4376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads