a0423aaabc55d4f4d6b62a2c2a587670aec88f04aee56202ccf994cb9de2bed8 | Triage

Analysis

max time kernel
1798s
max time network
1679s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:04

Sharing

Report Analysis Logs

General

Target

MONISEL.dll
Size

190KB
MD5

22be210f773c6b92d9ddd23982fd3267
SHA1

53523e311285de426974618b07b071afe34d1cef
SHA256

96e10192fbd794f53f91320bb5f9d02bae4879be19be598614cdafd91ccce43e
SHA512

a7de4099530ea5663ffc5539cc013115c75fc550a5be5b61b7f1edec3c7361bbaf64b989fffc23fb55cf51bf27c5d68dffad0fabfbcfd26a3031ff42657b3085
SSDEEP

3072:Jwn+XysRDaNP0t6lGqgZWXoUz5MJaokJxBpgN+ze51mSnd8s4jNPJ91m:Jwn7NPvGqgZxkBC8iqsi

Score

1^/10

Malware Config

Signatures

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CIRRUS.CIRRUSINTERFACE	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CIRRUS.CIRRUSINTERFACE\CLSID\ = "{0C5956C0-0B38-11D0-9803-080009BBCEE1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C5956C0-0B38-11D0-9803-080009BBCEE1}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CIRRUS.CIRRUSINTERFACE\ = "CIRRUS.CIRRUSINTERFACE"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C5956C0-0B38-11D0-9803-080009BBCEE1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C5956C0-0B38-11D0-9803-080009BBCEE1}\ = "CIRRUS.CIRRUSINTERFACE"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CIRRUS.CIRRUSINTERFACE\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C5956C0-0B38-11D0-9803-080009BBCEE1}\ProgID\ = "CIRRUS.CIRRUSINTERFACE"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C5956C0-0B38-11D0-9803-080009BBCEE1}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C5956C0-0B38-11D0-9803-080009BBCEE1}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MONISEL.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 4136	2916	regsvr32.exe	82
PID 2916 wrote to memory of 4136	2916	regsvr32.exe	82
PID 2916 wrote to memory of 4136	2916	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\MONISEL.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\MONISEL.dll
  2⤵
  - Modifies registry class
  PID:4136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads