60c4175e18abf22d705d855abb6f16e08b80b9fb829a08589b9e4ba750c47349

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SimpleExt64.dll
Size

145KB
MD5

23039590096e1b01f6e61b1fcd6b349b
SHA1

3a485d350ae596110faf29d9397892c8178a29f0
SHA256

3bef6a801b18439ef439914b3ad918940ce10baf6f701bf6027d13d8e4238c74
SHA512

871f4f29a3e8983299da7548b5b5440de64ae458739301ffcf4b7249f7a9440a0c7c8e686e0a22855910819c97075de63be4aca1faf763538eb261bfe25f7ea7
SSDEEP

1536:xFx1/vpPtb4CPacJ9XTDFlFx1Oz1UesQT4jmwUsVA:rD/vpPt/C2TDHtU1U5QT4jmwUsVA

Score

7^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SimpleExt64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SimpleExt64.dll"	regsvr32.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\ = "ScreenshoterRFShlExt Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E212111-0311-11D5-8D4B-444663541111}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\CLSID\{5E212111-0311-11D5-8D4B-444663541111}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SimpleExt64.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Directory\Background\shellex\ContextMenuHandlers\ScreenshoterRFShlExt	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Directory\Background\shellex\ContextMenuHandlers\ScreenshoterRFShlExt\ = "{5E212111-0311-11D5-8D4B-444663541111}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\ = "ScreenshoterRFShlExt Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SimpleExt64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\ScreenshoterRFShlExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shellex\ContextMenuHandlers\ScreenshoterRFShlExt\ = "{5E212111-0311-11D5-8D4B-444663541111}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\CLSID\{5E212111-0311-11D5-8D4B-444663541111}\InprocServer32	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SimpleExt64.dll
1⤵
- Registers COM server for autorun
- Modifies registry class
PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads