79f76160fd12d29b59c066ef907e293cc4802a7549edf0019842ea87936a742f

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ActiveStartupDeluxe.exe
Size

502KB
MD5

b48c6eafd3fbbb7879eb5fc455ff8d81
SHA1

c7aa38b1b7023d918086c9201dfe6f98ef2ad281
SHA256

c0d6bb12e8ad19ea72e34b67dfa985ec0e54936b21c738fc95dad7b0c5fa5e69
SHA512

29d6a8e73ff9e2bc60dd089c7db376b60f58f6f7984c1b8542de1d6022a2132e6878f9ff5b427907c35765c72567d2f53be2d89cb9e041db76aa136dc57fc456
SSDEEP

12288:X3mB8jikF5J5tHz9pDdRPHvhNAKUEbLbKhcksQ8bE8FJcaGWKrh:XWB6PJnptXfvhNVUAb95QiFGWKrh

Score

1^/10

Malware Config

Signatures

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}\ProgID	ActiveStartupDeluxe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}\InprocServer32	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}\Programmable\	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}\1.0\0\win64\	ActiveStartupDeluxe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}\1.0\FLAGS	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}\1.0\FLAGS\ = "0"	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}\1.0\0\	ActiveStartupDeluxe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}\TypeLib	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}\TypeLib\	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}\VersionIndependentProgID\ = "IMAPI2.MsftWriteEngine2"	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}\ = "Amilofimi Vedokasa Object"	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}\InprocServer32\	ActiveStartupDeluxe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}\1.0\ = "Microsoft WSMAN Automation V1.0 Library"	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}\VersionIndependentProgID\	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}\ProgID\ = "IMAPI2.MsftWriteEngine2.1"	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}\1.0\	ActiveStartupDeluxe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}\1.0\0	ActiveStartupDeluxe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	ActiveStartupDeluxe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}\Programmable	ActiveStartupDeluxe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}\1.0	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}\1.0\0\win32\ = "C:\\Windows\\SysWOW64\\WsmAuto.dll"	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}\1.0\FLAGS\	ActiveStartupDeluxe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}\1.0\HELPDIR	ActiveStartupDeluxe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}\Version	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}\Version\	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	ActiveStartupDeluxe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}\InprocServer32\ = "C:\\Windows\\SysWOW64\\imapi2.dll"	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}\ProgID\	ActiveStartupDeluxe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}\1.0\0\win32	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}\1.0\0\win64\ = "C:\\Windows\\SysWow64\\WsmAuto.dll"	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}\TypeLib\ = "{2FD02198-5763-6150-C896-9F6268AD8D79}"	ActiveStartupDeluxe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}\VersionIndependentProgID	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}\	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}\1.0\0\win32\	ActiveStartupDeluxe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}\1.0\0\win64	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}\1.0\HELPDIR\	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2FD02198-5763-6150-C896-9F6268AD8D79}\1.0\HELPDIR\ = "%systemroot%\\SysWow64\\"	ActiveStartupDeluxe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BA1A89-CBB2-4D1C-F7A5-16259658FF4F}\Version\ = "1.0"	ActiveStartupDeluxe.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
372	ActiveStartupDeluxe.exe
372	ActiveStartupDeluxe.exe
372	ActiveStartupDeluxe.exe
372	ActiveStartupDeluxe.exe
372	ActiveStartupDeluxe.exe
372	ActiveStartupDeluxe.exe
372	ActiveStartupDeluxe.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
372	ActiveStartupDeluxe.exe
372	ActiveStartupDeluxe.exe
372	ActiveStartupDeluxe.exe
372	ActiveStartupDeluxe.exe
372	ActiveStartupDeluxe.exe
372	ActiveStartupDeluxe.exe
372	ActiveStartupDeluxe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
372	ActiveStartupDeluxe.exe

C:\Users\Admin\AppData\Local\Temp\ActiveStartupDeluxe.exe
"C:\Users\Admin\AppData\Local\Temp\ActiveStartupDeluxe.exe"
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_default.asd

Filesize
329B

MD5
61beb213af3389863ed85e41392fc3e4

SHA1
0d2965d685daf38b68c48dcbff99aa7a62ef27cf

SHA256
9afab853186c7eb690a7c52734533a72a7ca894f5ea3a8616e6eb3e9cf2abfef

SHA512
16f1e2089e5d553c8e68eb877aedb56628019d0dc537dc8098524f6d636c8a394a3b88865941f71f2278594e54ededa9add0dea1f0937988451794c3267e8d71

Download Submit
memory/372-0-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/372-1-0x0000000002310000-0x0000000002343000-memory.dmp

Filesize
204KB

Download
memory/372-8-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/372-7-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/372-6-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/372-5-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/372-4-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/372-3-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/372-2-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/372-9-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/372-13-0x0000000002500000-0x0000000002503000-memory.dmp

Filesize
12KB

Download
memory/372-12-0x0000000002510000-0x0000000002512000-memory.dmp

Filesize
8KB

Download
memory/372-11-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/372-10-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/372-14-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/372-15-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/372-44-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/372-51-0x00000000028B0000-0x00000000028B1000-memory.dmp

Filesize
4KB

Download
memory/372-50-0x00000000028C0000-0x00000000028C1000-memory.dmp

Filesize
4KB

Download
memory/372-49-0x0000000002890000-0x0000000002891000-memory.dmp

Filesize
4KB

Download
memory/372-48-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/372-47-0x0000000002870000-0x0000000002871000-memory.dmp

Filesize
4KB

Download
memory/372-46-0x0000000002880000-0x0000000002881000-memory.dmp

Filesize
4KB

Download
memory/372-45-0x0000000002840000-0x0000000002841000-memory.dmp

Filesize
4KB

Download
memory/372-43-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download
memory/372-42-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/372-41-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/372-40-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/372-39-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/372-38-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/372-37-0x00000000026C0000-0x00000000026C1000-memory.dmp

Filesize
4KB

Download
memory/372-36-0x00000000026D0000-0x00000000026D1000-memory.dmp

Filesize
4KB

Download
memory/372-35-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/372-34-0x00000000026B0000-0x00000000026B1000-memory.dmp

Filesize
4KB

Download
memory/372-33-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/372-32-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/372-31-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/372-30-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/372-29-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/372-28-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/372-27-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/372-26-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/372-25-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/372-24-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/372-23-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/372-22-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/372-21-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/372-20-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/372-19-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/372-18-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/372-17-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/372-16-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/372-54-0x0000000002A00000-0x0000000002A01000-memory.dmp

Filesize
4KB

Download
memory/372-53-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/372-52-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/372-55-0x0000000002A40000-0x0000000002A41000-memory.dmp

Filesize
4KB

Download
memory/372-56-0x0000000002A30000-0x0000000002A31000-memory.dmp

Filesize
4KB

Download
memory/372-58-0x0000000002A20000-0x0000000002A21000-memory.dmp

Filesize
4KB

Download
memory/372-57-0x0000000002310000-0x0000000002343000-memory.dmp

Filesize
204KB

Download
memory/372-59-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/372-61-0x0000000002E30000-0x0000000002E31000-memory.dmp

Filesize
4KB

Download
memory/372-60-0x0000000002E40000-0x0000000002E41000-memory.dmp

Filesize
4KB

Download
memory/372-63-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/372-62-0x0000000002E60000-0x0000000002E61000-memory.dmp

Filesize
4KB

Download
memory/372-89-0x0000000004610000-0x0000000004611000-memory.dmp

Filesize
4KB

Download
memory/372-88-0x0000000004600000-0x0000000004601000-memory.dmp

Filesize
4KB

Download
memory/372-87-0x00000000045E0000-0x00000000045E1000-memory.dmp

Filesize
4KB

Download
memory/372-86-0x00000000045F0000-0x00000000045F1000-memory.dmp

Filesize
4KB

Download
memory/372-85-0x00000000045C0000-0x00000000045C1000-memory.dmp

Filesize
4KB

Download
memory/372-84-0x00000000045D0000-0x00000000045D1000-memory.dmp

Filesize
4KB

Download
memory/372-83-0x00000000045A0000-0x00000000045A1000-memory.dmp

Filesize
4KB

Download
memory/372-82-0x00000000045B0000-0x00000000045B1000-memory.dmp

Filesize
4KB

Download
memory/372-81-0x0000000004580000-0x0000000004581000-memory.dmp

Filesize
4KB

Download
memory/372-80-0x0000000004590000-0x0000000004591000-memory.dmp

Filesize
4KB

Download
memory/372-79-0x0000000004560000-0x0000000004561000-memory.dmp

Filesize
4KB

Download
memory/372-78-0x0000000004570000-0x0000000004571000-memory.dmp

Filesize
4KB

Download
memory/372-77-0x0000000004540000-0x0000000004541000-memory.dmp

Filesize
4KB

Download
memory/372-76-0x0000000004550000-0x0000000004551000-memory.dmp

Filesize
4KB

Download
memory/372-75-0x0000000004520000-0x0000000004521000-memory.dmp

Filesize
4KB

Download
memory/372-74-0x0000000004530000-0x0000000004531000-memory.dmp

Filesize
4KB

Download
memory/372-73-0x0000000004500000-0x0000000004501000-memory.dmp

Filesize
4KB

Download
memory/372-72-0x0000000004510000-0x0000000004511000-memory.dmp

Filesize
4KB

Download
memory/372-71-0x00000000044E0000-0x00000000044E1000-memory.dmp

Filesize
4KB

Download
memory/372-70-0x00000000044F0000-0x00000000044F1000-memory.dmp

Filesize
4KB

Download
memory/372-69-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/372-68-0x00000000044D0000-0x00000000044D1000-memory.dmp

Filesize
4KB

Download
memory/372-67-0x00000000044A0000-0x00000000044A1000-memory.dmp

Filesize
4KB

Download
memory/372-66-0x00000000044B0000-0x00000000044B1000-memory.dmp

Filesize
4KB

Download
memory/372-65-0x0000000004480000-0x0000000004481000-memory.dmp

Filesize
4KB

Download
memory/372-64-0x0000000004490000-0x0000000004491000-memory.dmp

Filesize
4KB

Download
memory/372-93-0x0000000004640000-0x0000000004641000-memory.dmp

Filesize
4KB

Download
memory/372-92-0x0000000004650000-0x0000000004651000-memory.dmp

Filesize
4KB

Download
memory/372-91-0x0000000004620000-0x0000000004621000-memory.dmp

Filesize
4KB

Download
memory/372-90-0x0000000004630000-0x0000000004631000-memory.dmp

Filesize
4KB

Download
memory/372-107-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/372-108-0x0000000002A20000-0x0000000002A21000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads