ad639bb9d966273c305fc59b2f2a661cfb77944cd4aa0c83e3333c65cc13a510

Analysis

max time kernel
129s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DTGadget64.dll
Size

497KB
MD5

72f7eae5ff8544f5ed2f8e20f10d8089
SHA1

b3e84f951b1330ba8691e936e436f4e61ce28b41
SHA256

365daf7571d0976fd42f6cea44c08f85ab94705851e770ee7e64d4d95f5b383c
SHA512

be70f7d1b1e741bd4fec6a4cd670c88365b312d39f8d60868d1414a90e1b99aa7ae243924403774a326e61a9df309dbf06ed9ad9fde60a6f304a5253e3d6cbda
SSDEEP

6144:oFnOxKVA8CQfpHPqnRhRpe/ua0ovvkWKZWlumr+TFApTR+5eqqDL60xlzlfb3gxo:FKVaG5CnJAcovsdzAu57qn6e6x4l

Score

7^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DTGadget64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DTGadget64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\InprocServer32	regsvr32.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.RSS.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEC8A564-EF2C-4D4F-BDED-D01E03D9DDD1}\TypeLib\ = "{F8E2D871-AB68-415A-9EF7-027F7C560AAC}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8E2D871-AB68-415A-9EF7-027F7C560AAC}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.RSS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8E2D871-AB68-415A-9EF7-027F7C560AAC}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEC8A564-EF2C-4D4F-BDED-D01E03D9DDD1}\TypeLib\ = "{F8E2D871-AB68-415A-9EF7-027F7C560AAC}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEC8A564-EF2C-4D4F-BDED-D01E03D9DDD1}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.GadgetControl.1\ = "GadgetControl Class"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\ = "IGadgetControl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DTGadget.DLL\AppID = "{F574FC8D-EFB4-4DAB-AA18-B6C688A8CC58}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\TypeLib\ = "{F8E2D871-AB68-415A-9EF7-027F7C560AAC}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\ = "GadgetControl Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.RSS.1\ = "RSS Class"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8E2D871-AB68-415A-9EF7-027F7C560AAC}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\ProgID\ = "DTLiteGadget.GadgetControl.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.RSS\CLSID\ = "{46F8ADC5-0EA1-49d7-9657-56A50133CD42}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8E2D871-AB68-415A-9EF7-027F7C560AAC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8E2D871-AB68-415A-9EF7-027F7C560AAC}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F574FC8D-EFB4-4DAB-AA18-B6C688A8CC58}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\ = "RSS Class"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\TypeLib\ = "{F8E2D871-AB68-415A-9EF7-027F7C560AAC}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.GadgetControl\ = "GadgetControl Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\VersionIndependentProgID\ = "DTLiteGadget.GadgetControl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEC8A564-EF2C-4D4F-BDED-D01E03D9DDD1}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.GadgetControl.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\TypeLib\ = "{F8E2D871-AB68-415A-9EF7-027F7C560AAC}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEC8A564-EF2C-4D4F-BDED-D01E03D9DDD1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEC8A564-EF2C-4D4F-BDED-D01E03D9DDD1}\ProxyStubClsid32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.GadgetControl.1	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8E2D871-AB68-415A-9EF7-027F7C560AAC}\1.0\ = "DTGadget 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8E2D871-AB68-415A-9EF7-027F7C560AAC}\1.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEC8A564-EF2C-4D4F-BDED-D01E03D9DDD1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.GadgetControl\CLSID\ = "{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.GadgetControl\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2AC045F-70EC-41F2-B77E-D2A44BE4BCAF}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.RSS\ = "RSS Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{476B3CEC-34F4-4B44-800C-918202FABD51}\TypeLib\ = "{F8E2D871-AB68-415A-9EF7-027F7C560AAC}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEC8A564-EF2C-4D4F-BDED-D01E03D9DDD1}\ = "IRSS"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DTLiteGadget.GadgetControl	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{46F8ADC5-0EA1-49d7-9657-56A50133CD42}\VersionIndependentProgID\ = "DTLiteGadget.RSS"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\DTGadget64.dll
1⤵
- Registers COM server for autorun
- Modifies registry class
PID:436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads