3fd157484c55d7b3871ed546865836985ec4995a38fae1b1719ceed6dfb5bb67

Analysis

max time kernel
78s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Kernel/PPStream/ppsimage.dll
Size

339KB
MD5

8c72ccfdc2433978491b3aa7464e6fdc
SHA1

8bef1052ae35db4583add9a8f1044904788fc0de
SHA256

94e0ba93840a54508f098ef43aed4fb01f661606141223426d069a00d65b7fcd
SHA512

0e76a8b3993fcb5e707b769f3dc7962e2e50626630ae2940a43a77d2c3883faecebea6258e5ef36b500db42746d36c6d98e72c54b3c95d53d21edaddd3bcd10e
SSDEEP

6144:GqHtla4kOJ+VsV1xWmf9Pz4Nw2PvM7DRxmew2v6wV5wimWTBKLVZVsHI:GqHt+c+Vm1xWMPwKR16yQWTE

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Image.PPSImage	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77272D62-F21A-4D7B-9D44-AE04220B9086}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Image.PPSPicture	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Image.PPSPicture\CLSID\ = "{00FBDAD7-B253-40FD-86C7-0FE4034A03C5}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00FBDAD7-B253-40FD-86C7-0FE4034A03C5}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00FBDAD7-B253-40FD-86C7-0FE4034A03C5}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00FBDAD7-B253-40FD-86C7-0FE4034A03C5}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Kernel\\PPStream\\ppsimage.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00FBDAD7-B253-40FD-86C7-0FE4034A03C5}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F21FC66-D76B-48DD-94C0-278F8E677C3C}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35BC41F4-274A-4C1A-9D32-E666DF185AD0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35BC41F4-274A-4C1A-9D32-E666DF185AD0}\TypeLib\ = "{A0427FCE-9B13-4941-A194-3C6035260BDD}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Image.PPSPicture.1\CLSID\ = "{00FBDAD7-B253-40FD-86C7-0FE4034A03C5}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Image.PPSPicture\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F21FC66-D76B-48DD-94C0-278F8E677C3C}\ = "IPPSImage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77272D62-F21A-4D7B-9D44-AE04220B9086}\ = "PPSImage Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77272D62-F21A-4D7B-9D44-AE04220B9086}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Kernel\\PPStream\\ppsimage.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77272D62-F21A-4D7B-9D44-AE04220B9086}\TypeLib\ = "{A0427FCE-9B13-4941-A194-3C6035260BDD}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Image.PPSPicture\CurVer	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00FBDAD7-B253-40FD-86C7-0FE4034A03C5}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A0427FCE-9B13-4941-A194-3C6035260BDD}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A0427FCE-9B13-4941-A194-3C6035260BDD}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Kernel\\PPStream"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35BC41F4-274A-4C1A-9D32-E666DF185AD0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77272D62-F21A-4D7B-9D44-AE04220B9086}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35BC41F4-274A-4C1A-9D32-E666DF185AD0}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77272D62-F21A-4D7B-9D44-AE04220B9086}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77272D62-F21A-4D7B-9D44-AE04220B9086}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00FBDAD7-B253-40FD-86C7-0FE4034A03C5}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F21FC66-D76B-48DD-94C0-278F8E677C3C}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Image.PPSImage\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Image.PPSImage\CurVer\ = "Image.PPSImage.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00FBDAD7-B253-40FD-86C7-0FE4034A03C5}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00FBDAD7-B253-40FD-86C7-0FE4034A03C5}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00FBDAD7-B253-40FD-86C7-0FE4034A03C5}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F21FC66-D76B-48DD-94C0-278F8E677C3C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77272D62-F21A-4D7B-9D44-AE04220B9086}\ProgID\ = "Image.PPSImage.1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00FBDAD7-B253-40FD-86C7-0FE4034A03C5}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77272D62-F21A-4D7B-9D44-AE04220B9086}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F21FC66-D76B-48DD-94C0-278F8E677C3C}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35BC41F4-274A-4C1A-9D32-E666DF185AD0}\TypeLib\ = "{A0427FCE-9B13-4941-A194-3C6035260BDD}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A0427FCE-9B13-4941-A194-3C6035260BDD}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F21FC66-D76B-48DD-94C0-278F8E677C3C}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35BC41F4-274A-4C1A-9D32-E666DF185AD0}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Image.PPSPicture\ = "PPSPicture Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00FBDAD7-B253-40FD-86C7-0FE4034A03C5}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35BC41F4-274A-4C1A-9D32-E666DF185AD0}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35BC41F4-274A-4C1A-9D32-E666DF185AD0}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35BC41F4-274A-4C1A-9D32-E666DF185AD0}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Image.PPSImage.1\ = "PPSImage Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Image.PPSPicture.1\ = "PPSPicture Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Image.PPSPicture.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35BC41F4-274A-4C1A-9D32-E666DF185AD0}\ = "IPPSPicture"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Image.PPSImage.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Image.PPSImage\CLSID\ = "{77272D62-F21A-4D7B-9D44-AE04220B9086}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Image.PPSImage\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77272D62-F21A-4D7B-9D44-AE04220B9086}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00FBDAD7-B253-40FD-86C7-0FE4034A03C5}\ = "PPSPicture Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00FBDAD7-B253-40FD-86C7-0FE4034A03C5}\VersionIndependentProgID\ = "Image.PPSPicture"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00FBDAD7-B253-40FD-86C7-0FE4034A03C5}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A0427FCE-9B13-4941-A194-3C6035260BDD}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Kernel\\PPStream\\ppsimage.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35BC41F4-274A-4C1A-9D32-E666DF185AD0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Image.PPSImage\ = "PPSImage Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77272D62-F21A-4D7B-9D44-AE04220B9086}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A0427FCE-9B13-4941-A194-3C6035260BDD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A0427FCE-9B13-4941-A194-3C6035260BDD}\1.0\ = "Image 1.0 Type Library"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 1408	2812	regsvr32.exe	82
PID 2812 wrote to memory of 1408	2812	regsvr32.exe	82
PID 2812 wrote to memory of 1408	2812	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Kernel\PPStream\ppsimage.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Kernel\PPStream\ppsimage.dll
  2⤵
  - Modifies registry class
  PID:1408

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads