c0ab8779a77a35685345f40cb15c794e5789a7215129b53930be356c670305df

Analysis

max time kernel
51s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Outlook_4.83.901.0_20231017/outlka64.dll
Size

5.9MB
MD5

20dba31f4e211f6bea144a0d2880cc6e
SHA1

cdc90d1742b1a25487c2d3628103f80cfbc1a284
SHA256

2fe16173326ea26ff89df46c061afea8b7bad2b540e8db5bd578f44f85e6933d
SHA512

57885b1e08371fbe1e51e1f614f059437083219fac87c8f1c3c52c911ea205c6a6d09bfb7cc16da247023e2cfb8c4ed5f4f97fd1f3da5d04bd277d305a5a6483
SSDEEP

98304:rfylCoe3XL+0a4Lyx+9QKiuFWJ6pCsbM23XsDM:DWCoe3Ze+t5FWJ6pZbMyc

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\ProgID\ = "OL2003Addin.Addin.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin\ = "Addin Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\TypeLib\ = "{EC7B995D-7EFE-412A-8D3A-B3810BB97821}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\VersionIndependentProgID\ = "OL2003Addin.Addin"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Outlook_4.83.901.0_20231017\\outlka64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\ = "OL2003Addin 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\TypeLib\ = "{EC7B995D-7EFE-412A-8D3A-B3810BB97821}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin.1\ = "Addin Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\ = "IAddin"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\ = "IAddin"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin.1\CLSID\ = "{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin\CLSID\ = "{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1EF4A5-6BB4-4FA3-B3F8-4B28A7D5667F}\ = "Addin Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Outlook_4.83.901.0_20231017\\outlka64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Outlook_4.83.901.0_20231017"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\TypeLib\ = "{EC7B995D-7EFE-412A-8D3A-B3810BB97821}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OL2003Addin.Addin\CurVer\ = "OL2003Addin.Addin.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EC7B995D-7EFE-412A-8D3A-B3810BB97821}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0A8FF5CA-3B94-4713-B65C-82255CD5658F}\TypeLib\Version = "1.0"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Outlook_4.83.901.0_20231017\outlka64.dll
1⤵
- Modifies registry class
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...