48966605e7cf87996068ac1a2e563f90f6f152e710323792c633e10bcba480e4 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 12:33

Sharing

Report Analysis Logs

General

Target

UIAutomationCore.dll
Size

548KB
MD5

fd049c25a168d3de310d9207b7b6367b
SHA1

ec48264fc325579ea2d59f6f95957608a9a1d07f
SHA256

48966605e7cf87996068ac1a2e563f90f6f152e710323792c633e10bcba480e4
SHA512

d50c1b2db911cd303ac7b5eaef73badc9ef70ad7c2cf2a456b79ffde72f87fdaa25b06277fae6fa28c1a70a6f17d02db766f91df0ec4edb0ef05db0b7e988ca3
SSDEEP

12288:4bOHQ+4oLOo7VkvT46yMCgfMJDsbt5uMA/UnJUra2oof:2OHh4oLHsCgfMJDsbt5nB2o

Score

1^/10

Malware Config

Signatures

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ff48dba4-60ef-4201-aa87-54103eef594e}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6e29fabf-9977-42d1-8d0e-ca7e61ad87e6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8ACC2016-04A3-4343-B8E1-1870E35D6A41}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib\ = "{944DE083-8FB8-45CF-BCB7-C477ACB2F897}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8ACC2016-04A3-4343-B8E1-1870E35D6A41}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ff48dba4-60ef-4201-aa87-54103eef594e}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6e29fabf-9977-42d1-8d0e-ca7e61ad87e6}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6e29fabf-9977-42d1-8d0e-ca7e61ad87e6}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib\ = "{944DE083-8FB8-45CF-BCB7-C477ACB2F897}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8ACC2016-04A3-4343-B8E1-1870E35D6A41}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ff48dba4-60ef-4201-aa87-54103eef594e}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 344	1732	regsvr32.exe	28
PID 1732 wrote to memory of 344	1732	regsvr32.exe	28
PID 1732 wrote to memory of 344	1732	regsvr32.exe	28
PID 1732 wrote to memory of 344	1732	regsvr32.exe	28
PID 1732 wrote to memory of 344	1732	regsvr32.exe	28
PID 1732 wrote to memory of 344	1732	regsvr32.exe	28
PID 1732 wrote to memory of 344	1732	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\UIAutomationCore.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\UIAutomationCore.dll
  2⤵
  - Modifies registry class
  PID:344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads