465848b1fd5e3894ccbb9a515a613788db4c673cbe62136de869153b8e82bbf8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TSWorkspace.dll
Size

765KB
MD5

6a98f5dd115e6c706131142f645a9b50
SHA1

0458e6dae9bb4210bfe4d53872c071ca5afe998a
SHA256

465848b1fd5e3894ccbb9a515a613788db4c673cbe62136de869153b8e82bbf8
SHA512

daac0343f64d363f85cb11415d30942a79f210332b71efd4f2c1a44c031a18c4da77ac698484f09f8d8924304f5ab127eb7512621113063e5909a76bc0f10a21
SSDEEP

12288:cS10Vd4S0Us0eShHJ1MzxRHNEvYoxWZwNe+Xar3wXIB7GjFyi5/:c+0rYzx7YYoSce+XaMimsiJ

Score

1^/10

Malware Config

Signatures

Modifies registry class 60 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Workspace.Installer\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A95E9F1-1C07-4711-8DDA-10A35B26271E}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B4BE995-61E3-430C-8977-0B21E4427BE7}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B4BE995-61E3-430C-8977-0B21E4427BE7}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Workspace.Installer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D0C78BF-98BF-4B97-835E-E4269F8E038D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1D428C79-6E2E-4351-A361-C0401A03A0BA}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1D428C79-6E2E-4351-A361-C0401A03A0BA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E444E1B9-502C-44f9-B714-30DA330D0E8E}\ProgID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A4303C6-4F0C-4E55-A9FD-51FFB9FDBA72}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E444E1B9-502C-44f9-B714-30DA330D0E8E}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EBD94DE1-1FCE-4893-A7EB-6CB18630C0C3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Workspace.ResTypeRegistry	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E444E1B9-502C-44f9-B714-30DA330D0E8E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B4BE995-61E3-430C-8977-0B21E4427BE7}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Workspace.PolicyProcessor	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7071EC00-663B-4BC1-A1FA-B97F3B917C55}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B91E9062-52BE-4D45-ADF3-FCAEF08E9478}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B91E9062-52BE-4D45-ADF3-FCAEF08E9478}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A95E9F1-1C07-4711-8DDA-10A35B26271E}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D0C78BF-98BF-4B97-835E-E4269F8E038D}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE9F729-A4E0-4BED-9FB3-85F1858143B7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1D428C79-6E2E-4351-A361-C0401A03A0BA}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B4BE995-61E3-430C-8977-0B21E4427BE7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A4303C6-4F0C-4E55-A9FD-51FFB9FDBA72}\NumMethods\ = "8"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B91E9062-52BE-4D45-ADF3-FCAEF08E9478}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B4BE995-61E3-430C-8977-0B21E4427BE7}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A4303C6-4F0C-4E55-A9FD-51FFB9FDBA72}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E444E1B9-502C-44f9-B714-30DA330D0E8E}\ = "WorkspacePolicyProcessor Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E444E1B9-502C-44f9-B714-30DA330D0E8E}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E444E1B9-502C-44f9-B714-30DA330D0E8E}\AppID = "{3C3F40BC-60EB-4567-B90C-480C87C21AC1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7071EC00-663B-4BC1-A1FA-B97F3B917C55}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1D428C79-6E2E-4351-A361-C0401A03A0BA}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Workspace.PolicyProcessor\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A95E9F1-1C07-4711-8DDA-10A35B26271E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B4BE995-61E3-430C-8977-0B21E4427BE7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EBD94DE1-1FCE-4893-A7EB-6CB18630C0C3}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Workspace.ResTypeRegistry\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EBD94DE1-1FCE-4893-A7EB-6CB18630C0C3}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A4303C6-4F0C-4E55-A9FD-51FFB9FDBA72}\ProxyStubClsid32\ = "{3D0C78BF-98BF-4B97-835E-E4269F8E038D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E444E1B9-502C-44f9-B714-30DA330D0E8E}\ProgID\ = "Workspace.PolicyProcessor.1"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\WOW6432Node\Interface	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E444E1B9-502C-44f9-B714-30DA330D0E8E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TSWorkspace.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D0C78BF-98BF-4B97-835E-E4269F8E038D}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A4303C6-4F0C-4E55-A9FD-51FFB9FDBA72}\ = "IWorkspaceInstaller2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A4303C6-4F0C-4E55-A9FD-51FFB9FDBA72}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1D428C79-6E2E-4351-A361-C0401A03A0BA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D0C78BF-98BF-4B97-835E-E4269F8E038D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E444E1B9-502C-44f9-B714-30DA330D0E8E}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E444E1B9-502C-44f9-B714-30DA330D0E8E}\VersionIndependentProgID\ = "Workspace.PolicyProcessor"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BE9F729-A4E0-4BED-9FB3-85F1858143B7}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7071EC00-663B-4BC1-A1FA-B97F3B917C55}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1D428C79-6E2E-4351-A361-C0401A03A0BA}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D0C78BF-98BF-4B97-835E-E4269F8E038D}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 4664	452	regsvr32.exe	82
PID 452 wrote to memory of 4664	452	regsvr32.exe	82
PID 452 wrote to memory of 4664	452	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\TSWorkspace.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\TSWorkspace.dll
  2⤵
  - Modifies registry class
  PID:4664

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads