1e63365e306d9dcfe73b8c4809e74ddbbae45acea3b07e10c2e744b23249a8f0

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e63365e306d9dcfe73b8c4809e74ddbbae45acea3b07e10c2e744b23249a8f0.dll
Size

1.2MB
MD5

d9228d2f1fd1593c5bca84175eae4cde
SHA1

c55fa6b1595c295e8f6f0efb760c19154e6dbca1
SHA256

1e63365e306d9dcfe73b8c4809e74ddbbae45acea3b07e10c2e744b23249a8f0
SHA512

6b397cbc2a1ef5a73123316d733b8b21186508e0b8b307c147c3e5b5709c12bfb3a4bbed5e1d8d68118ad2bab51a9b231fcd3607f0a078a1039e0b2268e024a6
SSDEEP

12288:wUo3t8C3szFs+59ivJX5F49bHEaIJR90lKFvyDiqTOc1EMwV:fo3vXXIN+R98Cyi+OsM

Score

1^/10

Malware Config

Signatures

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\PrivacyShellExt	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\PrivacyShellExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\PrivacyShellExt\ = "{6D642CFA-40F8-4AE0-9144-538BC1D725E4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PrivacyShell.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PrivacyShell.DLL\AppID = "{D9A9DE7F-A259-4BC1-A348-87BC1053C4E8}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D642CFA-40F8-4AE0-9144-538BC1D725E4}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\PrivacyShellExt	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D642CFA-40F8-4AE0-9144-538BC1D725E4}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D642CFA-40F8-4AE0-9144-538BC1D725E4}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\PrivacyShellExt\ = "{6D642CFA-40F8-4AE0-9144-538BC1D725E4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{D9A9DE7F-A259-4BC1-A348-87BC1053C4E8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{D9A9DE7F-A259-4BC1-A348-87BC1053C4E8}\ = "PrivacyShell"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D642CFA-40F8-4AE0-9144-538BC1D725E4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D642CFA-40F8-4AE0-9144-538BC1D725E4}\ = "PrivacyShellExt Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6D642CFA-40F8-4AE0-9144-538BC1D725E4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1e63365e306d9dcfe73b8c4809e74ddbbae45acea3b07e10c2e744b23249a8f0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\PrivacyShellExt\ = "{6D642CFA-40F8-4AE0-9144-538BC1D725E4}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2144	1804	regsvr32.exe	91
PID 1804 wrote to memory of 2144	1804	regsvr32.exe	91
PID 1804 wrote to memory of 2144	1804	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1e63365e306d9dcfe73b8c4809e74ddbbae45acea3b07e10c2e744b23249a8f0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1e63365e306d9dcfe73b8c4809e74ddbbae45acea3b07e10c2e744b23249a8f0.dll
  2⤵
  - Modifies registry class
  PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3976 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:3428

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads