3133691453d52deda0e443d99f1565178e629a2ba4b31137bed01916b5b831f0 | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 06:46

Sharing

Report Analysis Logs

General

Target

$TEMP/dev60cgi/DesktopDMA.dll
Size

37KB
MD5

e691a8240cedbd2f4bd39d5748cecb2e
SHA1

823905682a9f3e025a414d7c51d401ed42578e6c
SHA256

2cb13006977f70303a309554f14d70f9b7adfb46fa0fd630ec0da1dc74ed765f
SHA512

d050e88728de6b9f90c2929b671e89bdf167c3ff89ad5d207f99696ad4e71c8b32cd988741656fc048fa49656806807043875c9792c1b6b7d809fb5da87f3143
SSDEEP

768:XkQ9kolKftV1jlPK/W+/GHBdwYXRRlBhuUNiNjUJr6vD83W/:zkolK1VXZBhuAiNol48m/

Score

1^/10

Malware Config

Signatures

Modifies registry class 5 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26753017-B5BB-4b67-BEE3-862676DE23DC}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$TEMP\\dev60cgi\\DesktopDMA.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26753017-B5BB-4b67-BEE3-862676DE23DC}\InprocServer32\ThreadingModel = "Free"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26753017-B5BB-4b67-BEE3-862676DE23DC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26753017-B5BB-4b67-BEE3-862676DE23DC}\ = "VSD DMA Transport"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26753017-B5BB-4b67-BEE3-862676DE23DC}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 388 wrote to memory of 876	388	regsvr32.exe	regsvr32.exe
PID 388 wrote to memory of 876	388	regsvr32.exe	regsvr32.exe
PID 388 wrote to memory of 876	388	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$TEMP\dev60cgi\DesktopDMA.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:388

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\$TEMP\dev60cgi\DesktopDMA.dll
2⤵
- Modifies registry class
PID:876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...