67edf175321f92df454c58fc64babaf1905a2843b0fe7105a3d5c6146c0e9898

Resubmissions

26/07/2024, 09:06

240726-k2ts4ssbnb 10

20/06/2024, 20:05

240620-yts4havhph 10

Analysis

max time kernel
1372s
max time network
1164s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GlobalProtect64/lib64/RTDService.dll
Size

442KB
MD5

7188ba7f46dbbe324472c22a814a884a
SHA1

dc855cbeef47a1945baebbf1b7abe7f9ed718549
SHA256

bf9b6a71f3c71ad3cbdb12f1d37cca025aafc1afc0120c783acb83e8ce54c3e5
SHA512

bba1af40d5f182380e20587282e8cb037f0dbf91ec28ae2ef2f88336fa155e8dcd4e4ffe27b6a7e3b2a3be67695e1c69c1d0a37d6bf6eb4ceafbf4543095e5ca
SSDEEP

6144:+mXdszM4ebIDp9FB7qJG8Ti1rrvcjr2s1Hw0q6aCxWRCmTYh5U:+g2MlbkFB7qJGZpGalR7

Score

5^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B415BA9-E543-41BD-8EB1-CB12A5B7678F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B415BA9-E543-41BD-8EB1-CB12A5B7678F}\ProgId\ = "Tos.RTD"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA792DC8-807E-43E3-B484-47465D82C4D1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA792DC8-807E-43E3-B484-47465D82C4D1}\1.0\ = "Tos.RTD"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Tos.RTD\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B415BA9-E543-41BD-8EB1-CB12A5B7678F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA792DC8-807E-43E3-B484-47465D82C4D1}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA792DC8-807E-43E3-B484-47465D82C4D1}\1.0\0\Win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B415BA9-E543-41BD-8EB1-CB12A5B7678F}\ = "Tos.RTD"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B415BA9-E543-41BD-8EB1-CB12A5B7678F}\ProgId	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B415BA9-E543-41BD-8EB1-CB12A5B7678F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B415BA9-E543-41BD-8EB1-CB12A5B7678F}\TypeLib\ = "{BA792DC8-807E-43E3-B484-47465D82C4D1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA792DC8-807E-43E3-B484-47465D82C4D1}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA792DC8-807E-43E3-B484-47465D82C4D1}\1.0\0\ = "win32"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA792DC8-807E-43E3-B484-47465D82C4D1}\1.0\0\Win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GlobalProtect64\\lib64\\RTDService.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Tos.RTD\ = "Tos.RTD"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Tos.RTD\CLSID\ = "{1B415BA9-E543-41BD-8EB1-CB12A5B7678F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA792DC8-807E-43E3-B484-47465D82C4D1}\ = "Tos.RTD"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA792DC8-807E-43E3-B484-47465D82C4D1}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BA792DC8-807E-43E3-B484-47465D82C4D1}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Tos.RTD	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1B415BA9-E543-41BD-8EB1-CB12A5B7678F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GlobalProtect64\\lib64\\RTDService.dll"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\GlobalProtect64\lib64\RTDService.dll
1⤵
- Modifies registry class
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads