d1132df2f76ce5a708ccf760732953f04f7922aecb2b86e9a5b1dd35494da72c

Analysis

max time kernel
146s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Plugin/ShellExt_x64.dll
Size

393KB
MD5

0d83f9c3fd4686065c2b043cafc6cbef
SHA1

21d1d93bd079269d5b80685caac952d097fead21
SHA256

653aba53aa7825b89065daccf985fce3e7386d5891f1ace71e79f2cd326c4ed8
SHA512

271cfecb7badd32b968d2d3535edca6ab08ce37e863371c079d34f8f5c0cea2f3b668ae42aa10343ca3878ce402481c20427c002261a0d0d21da56b51c978c17
SSDEEP

6144:nmE1o+/RLkgfIs64GhIL912xqtpCFZIN6D8jWiLLaj8TBzGcBXIi7NRCvB:nmE++ZLkgfp64GVqi7IN6DQjTlGclf8B

Score

4^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plugin\\ShellExt_x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plugin\\ShellExt_x64.dll"	regsvr32.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\ = "ShellExtLib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plugin\\ShellExt_x64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ProxyStubClsid32\ = "{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\0\win64	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon\CLSID\ = "{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ = "IShellApkInfo"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plugin\\ShellExt_x64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\TypeLib\ = "{32fe7cb4-3936-41af-bf31-6f8fc8f86ac9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\TypeLib\ = "{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame\ShellEx	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon\CurVer\ = "ShellExt.ShellIcon.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\ = "IShellApkInfo2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ = "PSFactoryBuffer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.apk\ = "apkfile_ldsgame"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon.1\ = "ShellIcon Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plugin\\ShellExt_x64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ = "IShellApkInfo"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\NumMethods\ = "13"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\ProxyStubClsid32\ = "{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\NumMethods\ = "16"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame\ShellEx\{00021500-0000-0000-C000-000000000046}\ = "{7AF42AD7-2C1D-4CAD-B0EC-7BD8B5EE6346}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\TypeLib\ = "{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Interface	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon.1\CLSID\ = "{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\TypeLib\ = "{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.apk	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\apkfile_ldsgame\ShellEx\IconHandler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Plugin"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\ = "IShellApkInfo2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShellExt.ShellIcon\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7af42ad7-2c1d-4cad-b0ec-7bd8b5ee6346}\ = "ShellIcon Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6D}\TypeLib\ = "{32FE7CB4-3936-41AF-BF31-6F8FC8F86AC9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94800CF5-4B69-43ED-A69E-5358DE0BCF6E}\ProxyStubClsid32	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Plugin\ShellExt_x64.dll
1⤵
- Registers COM server for autorun
- Modifies registry class
PID:4080

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads