Analysis

  • max time kernel
    92s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/07/2024, 14:36

General

  • Target

    V17 Sorunsuz Çalışan/dinput8.dll

  • Size

    128KB

  • MD5

    f66b293ad5afa49c2bd8b58bdc18d453

  • SHA1

    a64ba484761f06adc1494863949589a6e552fe4b

  • SHA256

    956fb3765572d00f6c08bcae11e9856a00a68107464a87b6ccc6c1ffed46b88a

  • SHA512

    09874fbdc37a34ce5cbcead9f89ff7273b671ad042ba15cdf120e5fdee9d597fe8908ca4f6670f487be223786698a2fd8513dbacdce00fcbbb8c4d4729e13105

  • SSDEEP

    3072:uHcpVMabeR0iujTE/yhSWbAJgUSJYt9c+eJ+VPa2s:WcpVM7lQTE/ygWUmXysDJ+a2

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Modifies registry class 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\V17 Sorunsuz Çalışan\dinput8.dll"
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1172

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1172-1-0x00007FFAEF6C0000-0x00007FFAEF6E5000-memory.dmp

    Filesize

    148KB

  • memory/1172-0-0x00007FFAEF6C1000-0x00007FFAEF6C2000-memory.dmp

    Filesize

    4KB