b4c371cb2c0eac1803e6c845f629814b2ce4c568022eb6a1c9ac1f293bf74f40 | Triage

Analysis

max time kernel
135s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 12:00

Sharing

Report Analysis Logs

General

Target

MsCtfMonitor.dll
Size

19KB
MD5

b43687c534a49700bf4b3c9898763752
SHA1

06a90f687a27a0aad07cec86e6e0a23270c5b0bc
SHA256

b4c371cb2c0eac1803e6c845f629814b2ce4c568022eb6a1c9ac1f293bf74f40
SHA512

f4372435b11218f93cd1a8501a4214ad79648f2ca9a41a96303116ca2c9d057b087982385561e4baa71ec0bdaf52abee4aa301cfa38546114153c0e69f3cd852
SSDEEP

384:rjYvPmG46JT3MeKcgqVDCHKAPQJXUMomjBk1Z8lWVsqWkt:+P4SDMKHV+HKqQJXUMDjBk1QW

Score

1^/10

Malware Config

Signatures

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\\{01575CFE-9A55-4003-A5E1-F38D1EBDCBE1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01575CFE-9A55-4003-A5E1-F38D1EBDCBE1}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 3884	2900	regsvr32.exe	90
PID 2900 wrote to memory of 3884	2900	regsvr32.exe	90
PID 2900 wrote to memory of 3884	2900	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\MsCtfMonitor.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\MsCtfMonitor.dll
  2⤵
  - Modifies registry class
  PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4440,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
1⤵
PID:2804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads